Skip to main content

Layers and operations

Each layer transforms the output of the previous layer. The pinned Input tab holds your source text and stays first.

Choose operations and templates​

Text includes Trim lines, Unique lines, Remove empty lines, Sort lines, Case transform, Limit lines, and Normalize Unicode. It also includes templates to remove ANSI color codes, collapse spaces and tabs, normalize line endings, or split simple lists.

Regex provides three operations:

  • Regex substitution replaces matches and keeps unmatched text.
  • Regex extraction produces output from matches, using your extraction template. No matches produce an empty string.
  • Filter lines keeps or removes whole lines that match a regex.

Redact and Extract provide templates for IP addresses, email addresses, MAC addresses, and credit-card candidates. Extract also includes UUIDs, ISO dates, HTTP(S) URLs, and hash candidates.

Filter contains NGINX templates. Error, warning, and info templates use the standard text error log. Keep NGINX errors includes error, crit, alert, and emerg entries. The 4xx and 5xx templates use the status field in common or combined access logs.

A template creates an editable regex layer with a predefined flavor. Select Add layer > Redact > Redact IPv4 to replace addresses with [IP].

Add Redact IPv4 after the filter. Four addresses become redaction markers.

Redaction templates are starting points: inspect the output before sharing it. Credit-card and hash matches are candidates, not verified values. ISO date extraction checks numeric ranges, not calendar validity.

Use Trim lines before Remove empty lines to remove whitespace-only lines too. Line operations recognize LF, CRLF, and CR. Use Normalize line endings to LF when you need one line-ending format. Split on commas and semicolons handles simple lists, not quoted CSV fields.

Change layer settings​

The controls below the tabs show settings for the selected operation:

  • Sort direction selects Ascending or Descending.
  • Case selects Uppercase or Lowercase.
  • Filter mode selects Keep matches or Remove matches.
  • Keep selects the first or last number of lines. The default is the first 10 lines.
  • Normalization form selects NFC, NFD, NFKC, or NFKD. The default is NFC.

Tab actions also contains operation choices. Set the line count in the layer controls. Regex layers also have their own flavor, pattern, flags, and replacement or extraction template.

To switch operations, open Tab actions > Operation. Regex layers can switch between Substitution, Extract, and Filter lines. Text layers can switch between text operations. Shared fields stay unchanged. Operation-specific settings reset to their defaults. Switching to Filter lines discards the replacement or extraction template.

Switch an IPv4 regex from substitution to extraction. Use $&\n to return each address on a separate line.

Organize layers​

Select a tab to inspect its layer. Double-click its name to rename it. Drag transformation tabs to reorder them. Right-click a tab, or open Tab actions (⋮), to disable or delete it. Add layer after inserts a layer directly after that tab.

Insert Unique lines between redaction and sorting. The following layer receives the updated output.

A disabled layer passes its input through unchanged.

Disable Unique lines to pass duplicates through. Enable it again to restore the three-line result.

Pipeline actions > Clear pipeline removes the input and all transformation layers after confirmation. To keep the current pipeline, save a version before clearing it.