The ability to specify categories would match similar plugins offered from other log review tools. For example some low level logs have different keywords to search for per application and creating rule sets or categories would enable quicker log type definition to properly review a log with.

Let me find a log that is acceptable and i'll photoshop the layout of the feature i was describing. Basically picture the drop down menu that appears when pressing the highlight button..and have it show "Categories"....they would be user defined with names such as "Device Loglines", "Windows 2k3 Loglines", "Ubuntu PS Loglines" etc etc.....they would be groups of rules that would be turned on and off based on a single check mark instead of manually choosing among the 900 that i have generated since i downloaded this yesterday. I will need a day or two to draw up the example but thats the gist of the utility of groups/categories for highlighting rules.

Also i have a few other features for this log tool. Do i need to generate a new topic for each feature request?

Sigh. This one didnt make it into the 2.0 beta did it?... Any way i can bug you incessantly on the off chance that humor and forum based banter would inspire brilliant code to pour out of your fingers at amazing speed?

Wow. while this quickly enables us to "Turn On" already set rules the hope that i had for this request was to enable grouping (hopefully 2.1) where we would then be able to switch on and switch off dozens of rules rather quickly without having to guess what rules were turned on in another log of similar type. instead of remembering "per log" instead just create a general config file (or sqllite db, etc, etc) that generalizes highlighting rules so common rulesets can be grafted across many different log types with ease.

its the same way that storing bookmarks in a browser like Firefox would work...basically creating "Tags" on each rule and then allow folder grouping of a series of rules would be sufficient for massive rule trees and wouldn't require remembering hundreds of logs within the programs configuration system. Then if multiple rules need to be turned on only the folder itself within the rule tree would need to be clicked instead of manually clicking dozens of rules individually. This would make the program more resilient and organized over time as hundreds of logs are reviewed (my copy from rule list is starting to grow RAPIDLY)...so hopefully this explains a much easier approach to implementing a much simpler ruleset architecture.

I am just revisiting this to see if the functionality is coming along as planned for this feature? If further explanation is needed please let me know.

reallly really cant wait for this feature. i am having to manually rebuild my entire highlight library due to a dead harddrive. i had around 300 rules in place.

are there any updates on this feature?

Just to let you know I am still hoping for this feature to make it into the pipeline someday .

The tools has come a very long way and this application is excellent. FYI, I am now rebuilding many of my logs highlighting rules from scratch as i have a plethora of new log types I aggregate now.