lq filter¶

Filter log files with simple, grep-like syntax.

Alias: blq f

Synopsis¶

blq filter [OPTIONS] [EXPRESSION...] [FILE...]
blq f [OPTIONS] [EXPRESSION...] [FILE...]

Description¶

The filter command provides a simple, grep-like interface for filtering log events. Unlike query which uses SQL syntax, filter uses intuitive key=value expressions.

Options¶

Option	Description
`-v, --invert`	Invert match (show non-matching rows)
`-c, --count`	Only print count of matches
`-i, --ignore-case`	Case insensitive matching
`-n, --limit N`	Maximum rows to return
`--json, -j`	Output as JSON
`--csv`	Output as CSV
`--markdown, --md`	Output as Markdown table

Filter Expressions¶

Exact Match (`=`)¶

blq f severity=error build.log
blq f ref_file=src/main.c build.log

Multiple Values (`=v1,v2`)¶

Matches if the field equals any of the values (OR):

blq f severity=error,warning build.log

Equivalent SQL: severity IN ('error', 'warning')

Contains (`~`)¶

Pattern matching with ILIKE (case insensitive):

blq f ref_file~main build.log
blq f message~undefined build.log

Equivalent SQL: ref_file ILIKE '%main%'

Not Equal (`!=`)¶

blq f severity!=info build.log

Multiple Expressions¶

Multiple expressions are combined with AND:

blq f severity=error ref_file~main build.log

Equivalent SQL: severity = 'error' AND ref_file ILIKE '%main%'

Examples¶

Filter Errors¶

blq f severity=error build.log

Filter Errors and Warnings¶

blq f severity=error,warning build.log

Filter by File¶

blq f ref_file~utils build.log
blq f ref_file~.c build.log     # All C files

Exclude Info Messages¶

blq f severity!=info build.log

Invert Match¶

Show everything except errors (like grep -v):

blq f -v severity=error build.log

Count Matches¶

blq f -c severity=error build.log
# Output: 5

Case Insensitive¶

blq f -i message~error build.log

Combine Options¶

blq f -c severity=error,warning ref_file~main build.log

Query Stored Events¶

Without a file, queries stored events:

blq f severity=error
blq f -c severity=warning

Output Formats¶

blq f severity=error --json build.log
blq f severity=error --csv build.log

Comparison with query¶

Task	filter	query
Errors only	`blq f severity=error`	`blq q -f "severity='error'"`
Contains	`blq f ref_file~main`	`blq q -f "ref_file LIKE '%main%'"`
Multiple values	`blq f severity=error,warning`	`blq q -f "severity IN ('error','warning')"`
Select columns	Not supported	`blq q -s ref_file,message`
Complex SQL	Not supported	`blq q -f "ref_line > 100"`

Use filter for quick, simple filtering. Use query when you need column selection, complex conditions, or ordering.