[prql] refinements

NEWS.md

@@ -45,6 +45,13 @@ Interface changes:
 * The `{` / `}` hotkeys, `:next-section`, and `:prev-section`
   commands now work in the LOG view and take you to the
   next/previous partition.
+* The DB view now defaults to not showing bar charts.
+
+Breaking changes:
+* Many of the lesser used column in the log format tables
+  (e.g. `log_tags`) have been moved to after the columns
+  defined by the format.  These columns are usually `NULL`
+  and are a distraction when previewing queries.
 
 ## lnav v0.12.0
 

src/Makefile.am

@@ -120,12 +120,12 @@ AM_CXXFLAGS = $(CODE_COVERAGE_CXXFLAGS) $(USER_CXXFLAGS)
 
 if HAVE_CARGO
 RUST_DEPS_CPPFLAGS = -I$(srcdir)/third-party/prqlc-c -DHAVE_RUST_DEPS=1
-PRQLC_DIR = src/third-party/prqlc-c/target
+PRQLC_DIR = third-party/prqlc-c/target
 RUST_DEPS_LIBS = $(PRQLC_DIR)/release/libprqlc_c.a
 
 $(RUST_DEPS_LIBS): $(srcdir)/third-party/prqlc-c/src/lib.rs
 	mkdir -p $(PRQLC_DIR)
-	env CARGO_TARGET_DIR=src/third-party/prqlc-c/target $(CARGO_CMD) build --manifest-path \
+	env CARGO_TARGET_DIR=third-party/prqlc-c/target $(CARGO_CMD) build --manifest-path \
 	    $(srcdir)/third-party/prqlc-c/Cargo.toml --package prqlc-c --release
 
 else
@@ -584,7 +584,7 @@ DISTCLEANFILES = \
 
 if HAVE_CARGO
 clean-local:
-	env CARGO_TARGET_DIR=src/third-party/prqlc-c/target $(CARGO_CMD) clean --manifest-path \
+	env CARGO_TARGET_DIR=third-party/prqlc-c/target $(CARGO_CMD) clean --manifest-path \
     	    $(srcdir)/third-party/prqlc-c/Cargo.toml
 endif
 

src/command_executor.cc

@@ -282,9 +282,11 @@ execute_sql(exec_context& ec, const std::string& sql, std::string& alt_msg)
                 continue;
             }
 
+            auto stmt_al = attr_line_t(stmt_str);
+            readline_sqlite_highlighter(stmt_al, 0);
             auto um
                 = lnav::console::user_message::error(
-                      attr_line_t("unable to compile PRQL: ").append(stmt_str))
+                      attr_line_t("unable to compile PRQL: ").append(stmt_al))
                       .with_reason(msg.reason);
             if (msg.display && *msg.display) {
                 um.with_note(*msg.display);

src/hist_source.hh

@@ -92,6 +92,12 @@ public:
         return *this;
     }
 
+    stacked_bar_chart& with_show_state(show_state ss)
+    {
+        this->sbc_show_state = ss;
+        return *this;
+    }
+
     bool attrs_in_use(const text_attrs& attrs) const
     {
         for (const auto& ident : this->sbc_idents) {
@@ -249,7 +255,7 @@ public:
     {
         this->sbc_idents.clear();
         this->sbc_ident_lookup.clear();
-        this->sbc_show_state = show_all();
+        this->sbc_show_state = show_none();
     }
 
     void add_value(const T& ident, double amount = 1.0)
@@ -321,7 +327,7 @@ protected:
     unsigned long sbc_left{0}, sbc_right{0};
     std::vector<struct chart_ident> sbc_idents;
     std::unordered_map<T, unsigned int> sbc_ident_lookup;
-    show_state sbc_show_state{show_all()};
+    show_state sbc_show_state{show_none()};
 };
 
 class hist_source2

src/lnav_commands.cc

@@ -3897,9 +3897,10 @@ com_delete_tags(exec_context& ec,
 
             if (line_meta->empty(bookmark_metadata::categories::notes)) {
                 size_t off = std::distance(vbm.begin(), iter);
-                tc->set_user_mark(&textview_curses::BM_META, *iter, false);
+                auto vl = *iter;
+                tc->set_user_mark(&textview_curses::BM_META, vl, false);
                 if (line_meta->empty(bookmark_metadata::categories::any)) {
-                    lss.erase_bookmark_metadata(*iter);
+                    lss.erase_bookmark_metadata(vl);
                 }
 
                 iter = std::next(vbm.begin(), off);

src/log_vtab_impl.cc

@@ -55,22 +55,22 @@ static struct log_cursor log_cursor_latest;
 thread_local _log_vtab_data log_vtab_data;
 
 static const char* LOG_COLUMNS = R"(  (
-  log_line        INTEGER,            -- The line number for the log message
-  log_part        TEXT     COLLATE naturalnocase,  -- The partition the message is in
+  log_line        INTEGER,                         -- The line number for the log message
   log_time        DATETIME,                        -- The adjusted timestamp for the log message
-  log_actual_time DATETIME HIDDEN,                 -- The timestamp from the original log file for this message
-  log_idle_msecs  INTEGER,                         -- The difference in time between this messages and the previous
   log_level       TEXT     COLLATE loglevel,       -- The log message level
-  log_mark        BOOLEAN,                         -- True if the log message was marked
-  log_comment     TEXT,                            -- The comment for this message
-  log_tags        TEXT,                            -- A JSON list of tags for this message
-  log_annotations TEXT,                            -- A JSON object of annotations for this messages
-  log_filters     TEXT,                            -- A JSON list of filter IDs that matched this message
   -- BEGIN Format-specific fields:
 )";
 
 static const char* LOG_FOOTER_COLUMNS = R"(
   -- END Format-specific fields
+  log_part         TEXT     COLLATE naturalnocase,    -- The partition the message is in
+  log_actual_time  DATETIME HIDDEN,                   -- The timestamp from the original log file for this message
+  log_idle_msecs   INTEGER,                           -- The difference in time between this messages and the previous
+  log_mark         BOOLEAN,                           -- True if the log message was marked
+  log_comment      TEXT,                              -- The comment for this message
+  log_tags         TEXT,                              -- A JSON list of tags for this message
+  log_annotations  TEXT,                              -- A JSON object of annotations for this messages
+  log_filters      TEXT,                              -- A JSON list of filter IDs that matched this message
   log_opid         TEXT HIDDEN,                       -- The message's OPID
   log_format       TEXT HIDDEN,                       -- The name of the log file format
   log_format_regex TEXT HIDDEN,                       -- The name of the regex used to parse this log message
@@ -84,6 +84,14 @@ static const char* LOG_FOOTER_COLUMNS = R"(
 )";
 
 enum class log_footer_columns : uint32_t {
+    partition,
+    actual_time,
+    idle_msecs,
+    mark,
+    comment,
+    tags,
+    annotations,
+    filters,
     opid,
     format,
     format_regex,
@@ -292,6 +300,12 @@ struct log_vtab {
     textview_curses* tc{nullptr};
     logfile_sub_source* lss{nullptr};
     std::shared_ptr<log_vtab_impl> vi;
+
+    size_t footer_index(log_footer_columns col) const
+    {
+        return VT_COL_MAX + this->vi->vi_column_count
+            + lnav::enums::to_underlying(col);
+    }
 };
 
 struct vtab_cursor {
@@ -624,37 +638,6 @@ vt_column(sqlite3_vtab_cursor* cur, sqlite3_context* ctx, int col)
             break;
         }
 
-        case VT_COL_PARTITION: {
-            auto& vb = vt->tc->get_bookmarks();
-            const auto& bv = vb[&textview_curses::BM_PARTITION];
-
-            if (bv.empty()) {
-                sqlite3_result_null(ctx);
-            } else {
-                vis_line_t curr_line(vc->log_cursor.lc_curr_line);
-                auto iter = lower_bound(bv.begin(), bv.end(), curr_line + 1_vl);
-
-                if (iter != bv.begin()) {
-                    --iter;
-                    auto line_meta_opt = vt->lss->find_bookmark_metadata(*iter);
-                    if (line_meta_opt
-                        && !line_meta_opt.value()->bm_name.empty())
-                    {
-                        sqlite3_result_text(
-                            ctx,
-                            line_meta_opt.value()->bm_name.c_str(),
-                            line_meta_opt.value()->bm_name.size(),
-                            SQLITE_TRANSIENT);
-                    } else {
-                        sqlite3_result_null(ctx);
-                    }
-                } else {
-                    sqlite3_result_null(ctx);
-                }
-            }
-            break;
-        }
-
         case VT_COL_LOG_TIME: {
             char buffer[64];
 
@@ -664,63 +647,6 @@ vt_column(sqlite3_vtab_cursor* cur, sqlite3_context* ctx, int col)
             break;
         }
 
-        case VT_COL_LOG_ACTUAL_TIME: {
-            char buffer[64];
-
-            if (ll->is_time_skewed()) {
-                if (vc->line_values.lvv_values.empty()) {
-                    vc->cache_msg(lf, ll);
-                    require(vc->line_values.lvv_sbr.get_data() != nullptr);
-                    vt->vi->extract(lf, line_number, vc->line_values);
-                }
-
-                struct line_range time_range;
-
-                time_range = find_string_attr_range(vt->vi->vi_attrs,
-                                                    &logline::L_TIMESTAMP);
-
-                const auto* time_src
-                    = vc->line_values.lvv_sbr.get_data() + time_range.lr_start;
-                struct timeval actual_tv;
-                struct exttm tm;
-
-                if (lf->get_format()->lf_date_time.scan(
-                        time_src,
-                        time_range.length(),
-                        lf->get_format()->get_timestamp_formats(),
-                        &tm,
-                        actual_tv,
-                        false))
-                {
-                    sql_strftime(buffer, sizeof(buffer), actual_tv);
-                }
-            } else {
-                sql_strftime(
-                    buffer, sizeof(buffer), ll->get_time(), ll->get_millis());
-            }
-            sqlite3_result_text(ctx, buffer, strlen(buffer), SQLITE_TRANSIENT);
-            break;
-        }
-
-        case VT_COL_IDLE_MSECS:
-            if (vc->log_cursor.lc_curr_line == 0) {
-                sqlite3_result_int64(ctx, 0);
-            } else {
-                content_line_t prev_cl(
-                    vt->lss->at(vis_line_t(vc->log_cursor.lc_curr_line - 1)));
-                auto prev_lf = vt->lss->find(prev_cl);
-                auto prev_ll = prev_lf->begin() + prev_cl;
-                uint64_t prev_time, curr_line_time;
-
-                prev_time = prev_ll->get_time() * 1000ULL;
-                prev_time += prev_ll->get_millis();
-                curr_line_time = ll->get_time() * 1000ULL;
-                curr_line_time += ll->get_millis();
-                // require(curr_line_time >= prev_time);
-                sqlite3_result_int64(ctx, curr_line_time - prev_time);
-            }
-            break;
-
         case VT_COL_LEVEL: {
             const char* level_name = ll->get_level_name();
 
@@ -729,111 +655,208 @@ vt_column(sqlite3_vtab_cursor* cur, sqlite3_context* ctx, int col)
             break;
         }
 
-        case VT_COL_MARK: {
-            sqlite3_result_int(ctx, ll->is_marked());
-            break;
-        }
+        default:
+            if (col > (VT_COL_MAX + vt->vi->vi_column_count - 1)) {
+                auto footer_column = static_cast<log_footer_columns>(
+                    col - (VT_COL_MAX + vt->vi->vi_column_count - 1) - 1);
 
-        case VT_COL_LOG_COMMENT: {
-            auto line_meta_opt
-                = vt->lss->find_bookmark_metadata(vc->log_cursor.lc_curr_line);
-            if (!line_meta_opt || line_meta_opt.value()->bm_comment.empty()) {
-                sqlite3_result_null(ctx);
-            } else {
-                const auto& meta = *(line_meta_opt.value());
-                sqlite3_result_text(ctx,
-                                    meta.bm_comment.c_str(),
-                                    meta.bm_comment.length(),
-                                    SQLITE_TRANSIENT);
-            }
-            break;
-        }
+                switch (footer_column) {
+                    case log_footer_columns::partition: {
+                        auto& vb = vt->tc->get_bookmarks();
+                        const auto& bv = vb[&textview_curses::BM_PARTITION];
 
-        case VT_COL_LOG_TAGS: {
-            auto line_meta_opt
-                = vt->lss->find_bookmark_metadata(vc->log_cursor.lc_curr_line);
-            if (!line_meta_opt || line_meta_opt.value()->bm_tags.empty()) {
-                sqlite3_result_null(ctx);
-            } else {
-                const auto& meta = *(line_meta_opt.value());
+                        if (bv.empty()) {
+                            sqlite3_result_null(ctx);
+                        } else {
+                            vis_line_t curr_line(vc->log_cursor.lc_curr_line);
+                            auto iter = lower_bound(
+                                bv.begin(), bv.end(), curr_line + 1_vl);
+
+                            if (iter != bv.begin()) {
+                                --iter;
+                                auto line_meta_opt
+                                    = vt->lss->find_bookmark_metadata(*iter);
+                                if (line_meta_opt
+                                    && !line_meta_opt.value()->bm_name.empty())
+                                {
+                                    sqlite3_result_text(
+                                        ctx,
+                                        line_meta_opt.value()->bm_name.c_str(),
+                                        line_meta_opt.value()->bm_name.size(),
+                                        SQLITE_TRANSIENT);
+                                } else {
+                                    sqlite3_result_null(ctx);
+                                }
+                            } else {
+                                sqlite3_result_null(ctx);
+                            }
+                        }
+                        break;
+                    }
+                    case log_footer_columns::actual_time: {
+                        char buffer[64];
+
+                        if (ll->is_time_skewed()) {
+                            if (vc->line_values.lvv_values.empty()) {
+                                vc->cache_msg(lf, ll);
+                                require(vc->line_values.lvv_sbr.get_data()
+                                        != nullptr);
+                                vt->vi->extract(
+                                    lf, line_number, vc->line_values);
+                            }
 
-                yajlpp_gen gen;
+                            struct line_range time_range;
 
-                yajl_gen_config(gen, yajl_gen_beautify, false);
+                            time_range = find_string_attr_range(
+                                vt->vi->vi_attrs, &logline::L_TIMESTAMP);
 
-                {
-                    yajlpp_array arr(gen);
+                            const auto* time_src
+                                = vc->line_values.lvv_sbr.get_data()
+                                + time_range.lr_start;
+                            struct timeval actual_tv;
+                            struct exttm tm;
 
-                    for (const auto& str : meta.bm_tags) {
-                        arr.gen(str);
+                            if (lf->get_format()->lf_date_time.scan(
+                                    time_src,
+                                    time_range.length(),
+                                    lf->get_format()->get_timestamp_formats(),
+                                    &tm,
+                                    actual_tv,
+                                    false))
+                            {
+                                sql_strftime(buffer, sizeof(buffer), actual_tv);
+                            }
+                        } else {
+                            sql_strftime(buffer,
+                                         sizeof(buffer),
+                                         ll->get_time(),
+                                         ll->get_millis());
+                        }
+                        sqlite3_result_text(
+                            ctx, buffer, strlen(buffer), SQLITE_TRANSIENT);
+                        break;
                     }
-                }
+                    case log_footer_columns::idle_msecs: {
+                        if (vc->log_cursor.lc_curr_line == 0) {
+                            sqlite3_result_int64(ctx, 0);
+                        } else {
+                            content_line_t prev_cl(vt->lss->at(
+                                vis_line_t(vc->log_cursor.lc_curr_line - 1)));
+                            auto prev_lf = vt->lss->find(prev_cl);
+                            auto prev_ll = prev_lf->begin() + prev_cl;
+                            uint64_t prev_time, curr_line_time;
+
+                            prev_time = prev_ll->get_time() * 1000ULL;
+                            prev_time += prev_ll->get_millis();
+                            curr_line_time = ll->get_time() * 1000ULL;
+                            curr_line_time += ll->get_millis();
+                            // require(curr_line_time >= prev_time);
+                            sqlite3_result_int64(ctx,
+                                                 curr_line_time - prev_time);
+                        }
+                        break;
+                    }
+                    case log_footer_columns::mark: {
+                        sqlite3_result_int(ctx, ll->is_marked());
+                        break;
+                    }
+                    case log_footer_columns::comment: {
+                        auto line_meta_opt = vt->lss->find_bookmark_metadata(
+                            vc->log_cursor.lc_curr_line);
+                        if (!line_meta_opt
+                            || line_meta_opt.value()->bm_comment.empty())
+                        {
+                            sqlite3_result_null(ctx);
+                        } else {
+                            const auto& meta = *(line_meta_opt.value());
+                            sqlite3_result_text(ctx,
+                                                meta.bm_comment.c_str(),
+                                                meta.bm_comment.length(),
+                                                SQLITE_TRANSIENT);
+                        }
+                        break;
+                    }
+                    case log_footer_columns::tags: {
+                        auto line_meta_opt = vt->lss->find_bookmark_metadata(
+                            vc->log_cursor.lc_curr_line);
+                        if (!line_meta_opt
+                            || line_meta_opt.value()->bm_tags.empty())
+                        {
+                            sqlite3_result_null(ctx);
+                        } else {
+                            const auto& meta = *(line_meta_opt.value());
 
-                to_sqlite(ctx, json_string(gen));
-            }
-            break;
-        }
+                            yajlpp_gen gen;
 
-        case VT_COL_LOG_ANNOTATIONS: {
-            if (sqlite3_vtab_nochange(ctx)) {
-                return SQLITE_OK;
-            }
+                            yajl_gen_config(gen, yajl_gen_beautify, false);
 
-            auto line_meta_opt
-                = vt->lss->find_bookmark_metadata(vc->log_cursor.lc_curr_line);
-            if (!line_meta_opt
-                || line_meta_opt.value()->bm_annotations.la_pairs.empty())
-            {
-                sqlite3_result_null(ctx);
-            } else {
-                const auto& meta = *(line_meta_opt.value());
-                to_sqlite(ctx,
-                          logmsg_annotations_handlers.to_json_string(
-                              meta.bm_annotations));
-            }
-            break;
-        }
+                            {
+                                yajlpp_array arr(gen);
 
-        case VT_COL_FILTERS: {
-            const auto& filter_mask
-                = (*ld)->ld_filter_state.lfo_filter_state.tfs_mask;
+                                for (const auto& str : meta.bm_tags) {
+                                    arr.gen(str);
+                                }
+                            }
 
-            if (!filter_mask[line_number]) {
-                sqlite3_result_null(ctx);
-            } else {
-                const auto& filters = vt->lss->get_filters();
-                yajlpp_gen gen;
+                            to_sqlite(ctx, json_string(gen));
+                        }
+                        break;
+                    }
+                    case log_footer_columns::annotations: {
+                        if (sqlite3_vtab_nochange(ctx)) {
+                            return SQLITE_OK;
+                        }
 
-                yajl_gen_config(gen, yajl_gen_beautify, false);
+                        auto line_meta_opt = vt->lss->find_bookmark_metadata(
+                            vc->log_cursor.lc_curr_line);
+                        if (!line_meta_opt
+                            || line_meta_opt.value()
+                                   ->bm_annotations.la_pairs.empty())
+                        {
+                            sqlite3_result_null(ctx);
+                        } else {
+                            const auto& meta = *(line_meta_opt.value());
+                            to_sqlite(
+                                ctx,
+                                logmsg_annotations_handlers.to_json_string(
+                                    meta.bm_annotations));
+                        }
+                        break;
+                    }
+                    case log_footer_columns::filters: {
+                        const auto& filter_mask
+                            = (*ld)->ld_filter_state.lfo_filter_state.tfs_mask;
 
-                {
-                    yajlpp_array arr(gen);
+                        if (!filter_mask[line_number]) {
+                            sqlite3_result_null(ctx);
+                        } else {
+                            const auto& filters = vt->lss->get_filters();
+                            yajlpp_gen gen;
 
-                    for (const auto& filter : filters) {
-                        if (filter->lf_deleted) {
-                            continue;
-                        }
+                            yajl_gen_config(gen, yajl_gen_beautify, false);
 
-                        uint32_t mask = (1UL << filter->get_index());
+                            {
+                                yajlpp_array arr(gen);
 
-                        if (filter_mask[line_number] & mask) {
-                            arr.gen(filter->get_index());
-                        }
-                    }
-                }
+                                for (const auto& filter : filters) {
+                                    if (filter->lf_deleted) {
+                                        continue;
+                                    }
 
-                to_sqlite(ctx, gen.to_string_fragment());
-                sqlite3_result_subtype(ctx, JSON_SUBTYPE);
-            }
-            break;
-        }
+                                    uint32_t mask
+                                        = (1UL << filter->get_index());
 
-        default:
-            if (col > (VT_COL_MAX + vt->vi->vi_column_count - 1)) {
-                auto footer_column = static_cast<log_footer_columns>(
-                    col - (VT_COL_MAX + vt->vi->vi_column_count - 1) - 1);
+                                    if (filter_mask[line_number] & mask) {
+                                        arr.gen(filter->get_index());
+                                    }
+                                }
+                            }
 
-                switch (footer_column) {
+                            to_sqlite(ctx, gen.to_string_fragment());
+                            sqlite3_result_subtype(ctx, JSON_SUBTYPE);
+                        }
+                        break;
+                    }
                     case log_footer_columns::opid: {
                         if (vc->line_values.lvv_values.empty()) {
                             vc->cache_msg(lf, ll);
@@ -1564,6 +1587,14 @@ vt_filter(sqlite3_vtab_cursor* p_vtc,
                             }
                             break;
                         }
+                        case log_footer_columns::partition:
+                        case log_footer_columns::actual_time:
+                        case log_footer_columns::idle_msecs:
+                        case log_footer_columns::mark:
+                        case log_footer_columns::comment:
+                        case log_footer_columns::tags:
+                        case log_footer_columns::annotations:
+                        case log_footer_columns::filters:
                         case log_footer_columns::text:
                         case log_footer_columns::body:
                         case log_footer_columns::raw_text:
@@ -1848,6 +1879,14 @@ vt_best_index(sqlite3_vtab* tab, sqlite3_index_info* p_info)
                                             sql_constraint_op_name(op)));
                             break;
                         }
+                        case log_footer_columns::partition:
+                        case log_footer_columns::actual_time:
+                        case log_footer_columns::idle_msecs:
+                        case log_footer_columns::mark:
+                        case log_footer_columns::comment:
+                        case log_footer_columns::tags:
+                        case log_footer_columns::annotations:
+                        case log_footer_columns::filters:
                         case log_footer_columns::text:
                         case log_footer_columns::body:
                         case log_footer_columns::raw_text:
@@ -1930,16 +1969,18 @@ vt_update(sqlite3_vtab* tab,
         && sqlite3_value_int64(argv[0]) == sqlite3_value_int64(argv[1]))
     {
         int64_t rowid = sqlite3_value_int64(argv[0]) >> 8;
-        int val = sqlite3_value_int(argv[2 + VT_COL_MARK]);
+        int val = sqlite3_value_int(
+            argv[2 + vt->footer_index(log_footer_columns::mark)]);
         vis_line_t vrowid(rowid);
 
-        const auto* part_name = sqlite3_value_text(argv[2 + VT_COL_PARTITION]);
-        const auto* log_comment
-            = sqlite3_value_text(argv[2 + VT_COL_LOG_COMMENT]);
+        const auto* part_name = sqlite3_value_text(
+            argv[2 + vt->footer_index(log_footer_columns::partition)]);
+        const auto* log_comment = sqlite3_value_text(
+            argv[2 + vt->footer_index(log_footer_columns::comment)]);
         const auto log_tags = from_sqlite<nonstd::optional<string_fragment>>()(
-            argc, argv, 2 + VT_COL_LOG_TAGS);
+            argc, argv, 2 + vt->footer_index(log_footer_columns::tags));
         const auto log_annos = from_sqlite<nonstd::optional<string_fragment>>()(
-            argc, argv, 2 + VT_COL_LOG_ANNOTATIONS);
+            argc, argv, 2 + vt->footer_index(log_footer_columns::annotations));
         bookmark_metadata tmp_bm;
 
         if (log_tags) {
@@ -2036,7 +2077,9 @@ vt_update(sqlite3_vtab* tab,
             if (log_annos) {
                 line_meta.bm_annotations = std::move(tmp_bm.bm_annotations);
             } else if (!sqlite3_value_nochange(
-                           argv[2 + VT_COL_LOG_ANNOTATIONS]))
+                           argv[2
+                                + vt->footer_index(
+                                    log_footer_columns::annotations)]))
             {
                 line_meta.bm_annotations.la_pairs.clear();
             }

src/log_vtab_impl.hh

@@ -44,16 +44,8 @@ class textview_curses;
 
 enum {
     VT_COL_LINE_NUMBER,
-    VT_COL_PARTITION,
     VT_COL_LOG_TIME,
-    VT_COL_LOG_ACTUAL_TIME,
-    VT_COL_IDLE_MSECS,
     VT_COL_LEVEL,
-    VT_COL_MARK,
-    VT_COL_LOG_COMMENT,
-    VT_COL_LOG_TAGS,
-    VT_COL_LOG_ANNOTATIONS,
-    VT_COL_FILTERS,
     VT_COL_MAX
 };
 

src/prelude.prql

@@ -1,2 +1,7 @@
-
 let json_each = func input -> s"SELECT * FROM json_each({input})"
+
+let count_by = func column rel <relation> -> <relation> (
+  rel
+  group {column} (aggregate {total = count this})
+  sort {-total}
+)

src/readline_callbacks.cc

@@ -140,7 +140,7 @@ const char *PRQL_HELP =
 
 const char *PRQL_EXAMPLE =
     ANSI_UNDERLINE("Examples") "\n"
-        "  from db.%s | group { log_level } (aggregate { total = count this })\n"
+        "  from db.%s | count_by { log_level }\n"
         "  from db.%s | filter log_line == lnav.view.top_line\n"
     ;
 
@@ -306,7 +306,6 @@ rl_change(readline_curses* rc)
     tc->get_highlights().erase({highlight_source_t::PREVIEW, "bodypreview"});
     lnav_data.ld_log_source.set_preview_sql_filter(nullptr);
     lnav_data.ld_user_message_source.clear();
-    clear_preview();
 
     switch (lnav_data.ld_mode) {
         case ln_mode_t::SQL: {
@@ -317,6 +316,10 @@ rl_change(readline_curses* rc)
             const auto line = rc->get_line_buffer();
             std::vector<std::string> args;
 
+            if (!lnav::sql::is_prql(line)) {
+                clear_preview();
+            }
+
             split_ws(line, args);
             if (!args.empty()) {
                 auto cmd_iter = sql_cmd_map->find(args[0]);
@@ -333,6 +336,8 @@ rl_change(readline_curses* rc)
             break;
         }
         case ln_mode_t::COMMAND: {
+            clear_preview();
+
             static std::string last_command;
             static int generation = 0;
 
@@ -453,6 +458,8 @@ rl_change(readline_curses* rc)
             break;
         }
         case ln_mode_t::EXEC: {
+            clear_preview();
+
             const auto line = rc->get_line_buffer();
             size_t name_end = line.find(' ');
             const auto script_name = line.substr(0, name_end);
@@ -577,7 +584,7 @@ rl_search_internal(readline_curses* rc, ln_mode_t mode, bool complete = false)
                                            "| take 1000 ");
                 }
                 curr_stage_prql.rtrim();
-                curr_stage_prql.append(" | take 10");
+                curr_stage_prql.append(" | take 5");
                 log_debug("preview prql: %s",
                           curr_stage_prql.get_string().c_str());
 
@@ -599,7 +606,7 @@ rl_search_internal(readline_curses* rc, ln_mode_t mode, bool complete = false)
                         prev_stage_prql.insert(riter->sa_range.lr_start,
                                                "| take 1000 ");
                     }
-                    prev_stage_prql.append(" | take 10");
+                    prev_stage_prql.append(" | take 5");
 
                     curr_stage_index = 1;
                     auto db_guard = lnav_data.ld_exec_context.enter_db_source(
@@ -640,13 +647,16 @@ rl_search_internal(readline_curses* rc, ln_mode_t mode, bool complete = false)
                 auto exec_res = execute_sql(lnav_data.ld_exec_context,
                                             curr_stage_prql.get_string(),
                                             alt_msg);
+                auto err = exec_res.isErr()
+                    ? exec_res.unwrapErr()
+                    : lnav::console::user_message::ok({});
                 if (exec_res.isErr()) {
-                    auto err = exec_res.unwrapErr();
-
                     lnav_data.ld_bottom_source.grep_error(
                         err.um_reason.get_string());
 
-                    auto near = term_val.length();
+                    curr_stage_prql.erase(curr_stage_prql.get_string().length()
+                                          - 9);
+                    auto near = curr_stage_prql.get_string().length() - 1;
                     while (near > 0) {
                         auto paren_iter = rfind_string_attr_if(
                             curr_stage_prql.get_attrs(),
@@ -659,20 +669,27 @@ rl_search_internal(readline_curses* rc, ln_mode_t mode, bool complete = false)
                         if (paren_iter == curr_stage_prql.get_attrs().end()) {
                             break;
                         }
-                        switch (term_val[paren_iter->sa_range.lr_start]) {
+                        switch (
+                            curr_stage_prql
+                                .get_string()[paren_iter->sa_range.lr_start])
+                        {
                             case '(':
-                                term_val.append(")");
+                                curr_stage_prql.append(")");
                                 break;
                             case '{':
-                                term_val.append("}");
+                                curr_stage_prql.append("}");
                                 break;
                         }
                         near = paren_iter->sa_range.lr_start - 1;
                     }
 
-                    auto exec_termed_res = execute_sql(
-                        lnav_data.ld_exec_context, term_val, alt_msg);
+                    curr_stage_prql.append(" | take 5");
+                    auto exec_termed_res
+                        = execute_sql(lnav_data.ld_exec_context,
+                                      curr_stage_prql.get_string(),
+                                      alt_msg);
                     if (exec_termed_res.isErr()) {
+                        err = exec_termed_res.unwrapErr();
                     }
                 } else {
                     lnav_data.ld_bottom_source.grep_error("");
@@ -714,7 +731,7 @@ rl_search_internal(readline_curses* rc, ln_mode_t mode, bool complete = false)
                                  [curr_stage_index]);
                 } else if (exec_res.isErr()) {
                     lnav_data.ld_preview_source[curr_stage_index].replace_with(
-                        exec_res.unwrapErr().to_attr_line());
+                        err.to_attr_line());
                     lnav_data.ld_preview_view[curr_stage_index].set_sub_source(
                         &lnav_data.ld_preview_source[curr_stage_index]);
                     lnav_data.ld_preview_view[curr_stage_index]

src/readline_curses.cc

@@ -408,9 +408,15 @@ readline_context::attempted_completion(const char* text, int start, int end)
     }
 
     completion_start = start;
-    if (at_start
-        && loaded_context->rc_possibilities.find(cmd_key)
-            != loaded_context->rc_possibilities.end())
+    if (text[0] == '\0' && !rc_local_suggestion.empty()) {
+        static std::set<std::string> suggestion_possibilities;
+
+        suggestion_possibilities.clear();
+        suggestion_possibilities.emplace(rc_local_suggestion);
+        arg_possibilities = &suggestion_possibilities;
+    } else if (at_start
+               && loaded_context->rc_possibilities.find(cmd_key)
+                   != loaded_context->rc_possibilities.end())
     {
         arg_possibilities = &loaded_context->rc_possibilities[cmd_key];
         arg_needs_shlex = false;

src/readline_highlighters.cc

@@ -243,6 +243,7 @@ readline_sqlite_highlighter_int(attr_line_t& al, int x, line_range sub)
     static const char* brackets[] = {
         "[]",
         "()",
+        "{}",
 
         nullptr,
     };

src/readline_possibilities.cc

@@ -40,6 +40,7 @@
 #include "lnav.hh"
 #include "lnav_config.hh"
 #include "log_data_helper.hh"
+#include "log_format_ext.hh"
 #include "service_tags.hh"
 #include "session_data.hh"
 #include "sql_help.hh"
@@ -71,13 +72,51 @@ handle_db_list(void* ptr, int ncols, char** colvalues, char** colnames)
     return 0;
 }
 
+static size_t
+files_with_format(log_format* format)
+{
+    auto retval = size_t{0};
+    for (const auto& lf : lnav_data.ld_active_files.fc_files) {
+        if (lf->get_format_name() == format->get_name()) {
+            retval += 1;
+        }
+    }
+
+    return retval;
+}
+
 static int
 handle_table_list(void* ptr, int ncols, char** colvalues, char** colnames)
 {
     if (lnav_data.ld_rl_view != nullptr) {
         std::string table_name = colvalues[0];
+        intern_string_t table_intern = intern_string::lookup(table_name);
+        auto format = log_format::find_root_format(table_name.c_str());
+        auto add_poss = true;
+
+        if (format != nullptr) {
+            if (files_with_format(format.get()) == 0) {
+                add_poss = false;
+            }
+        } else if (sqlite_function_help.count(table_name) != 0) {
+            add_poss = false;
+        } else {
+            for (const auto& lf : log_format::get_root_formats()) {
+                auto* elf = dynamic_cast<external_log_format*>(lf.get());
+                if (elf == nullptr) {
+                    continue;
+                }
+
+                if (elf->elf_search_tables.find(table_intern)
+                        != elf->elf_search_tables.end()
+                    && files_with_format(lf.get()) == 0)
+                {
+                    add_poss = false;
+                }
+            }
+        }
 
-        if (sqlite_function_help.count(table_name) == 0) {
+        if (add_poss) {
             lnav_data.ld_rl_view->add_possibility(
                 ln_mode_t::SQL, "*", table_name);
             lnav_data.ld_rl_view->add_possibility(

src/sql_commands.cc

@@ -334,7 +334,7 @@ prql_cmd_group(exec_context& ec,
     std::string retval;
 
     if (args.empty()) {
-        args.emplace_back("prql-column");
+        args.emplace_back("prql-expr");
         args.emplace_back("prql-source");
         return Ok(retval);
     }
@@ -504,7 +504,11 @@ static readline_context::command_t sql_commands[] = {
             .with_parameter(
                 help_text{"expr", "The aggregate expression(s)"}.with_grouping(
                     "{", "}"))
-            .with_example({"To group values into a JSON array", ""}),
+            .with_example({
+                "To group values into a JSON array",
+                "from [{a=1}, {a=2}] | aggregate { arr = json.group_array a }",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -527,7 +531,12 @@ static readline_context::command_t sql_commands[] = {
             .prql_transform()
             .with_summary("PRQL transform to derive one or more columns")
             .with_parameter(
-                help_text{"column", "The new column"}.with_grouping("{", "}")),
+                help_text{"column", "The new column"}.with_grouping("{", "}"))
+            .with_example({
+                "To add a column that is a multiplication of another",
+                "from [{a=1}, {a=2}] | derive b = a * 2",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -539,7 +548,12 @@ static readline_context::command_t sql_commands[] = {
             .prql_transform()
             .with_summary("PRQL transform to pick rows based on their values")
             .with_parameter(
-                {"expr", "The expression to evaluate over each row"}),
+                {"expr", "The expression to evaluate over each row"})
+            .with_example({
+                "To pick rows where 'a' is greater than one",
+                "from [{a=1}, {a=2}] | filter a > 1",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -555,7 +569,13 @@ static readline_context::command_t sql_commands[] = {
                     .with_grouping("{", "}"))
             .with_parameter(
                 help_text{"pipeline", "The pipeline to execute over a group"}
-                    .with_grouping("(", ")")),
+                    .with_grouping("(", ")"))
+            .with_example({
+                "To group by log_level and count the rows in each partition",
+                "from db.lnav_example_log | group { log_level } (aggregate { "
+                "count this })",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -584,10 +604,20 @@ static readline_context::command_t sql_commands[] = {
         prql_cmd_select,
         help_text("select")
             .prql_transform()
-            .with_summary("PRQL transform to select columns")
+            .with_summary("PRQL transform to pick and compute columns")
             .with_parameter(
                 help_text{"expr", "The columns to include in the result set"}
-                    .with_grouping("{", "}")),
+                    .with_grouping("{", "}"))
+            .with_example({
+                "To pick the 'b' column from the rows",
+                "from [{a=1, b='abc'}, {a=2, b='def'}] | select b",
+                help_example::language::prql,
+            })
+            .with_example({
+                "To compute a new column from an input",
+                "from [{a=1}, {a=2}] | select b = a * 2",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -600,7 +630,12 @@ static readline_context::command_t sql_commands[] = {
             .with_summary("PRQL transform to sort rows")
             .with_parameter(help_text{
                 "expr", "The values to use when ordering the result set"}
-                                .with_grouping("{", "}")),
+                                .with_grouping("{", "}"))
+            .with_example({
+                "To sort the rows in descending order",
+                "from [{a=1}, {a=2}] | sort {-a}",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},
@@ -611,7 +646,17 @@ static readline_context::command_t sql_commands[] = {
         help_text("take")
             .prql_transform()
             .with_summary("PRQL command to pick rows based on their position")
-            .with_parameter({"n_or_range", "The number of rows or range"}),
+            .with_parameter({"n_or_range", "The number of rows or range"})
+            .with_example({
+                "To pick the first row",
+                "from [{a=1}, {a=2}, {a=3}] | take 1",
+                help_example::language::prql,
+            })
+            .with_example({
+                "To pick the second and third rows",
+                "from [{a=1}, {a=2}, {a=3}] | take 2..3",
+                help_example::language::prql,
+            }),
         nullptr,
         "prql-source",
         {"prql-source"},

src/sql_util.cc

@@ -1291,27 +1291,16 @@ const char* prql_transforms[] = {
     "sort",
     "take",
     "window",
+
+    nullptr,
 };
 
 const char* prql_keywords[] = {
-    "average",
-    "avg",
-    "case",
-    "count",
-    "count_distinct",
-    "false",
-    "func",
-    "into",
-    "let",
-    "max",
-    "min",
-    "module",
-    "null",
-    "prql",
-    "stddev",
-    "sum",
-    "true",
-    "type",
+    "average", "avg", "case", "count", "count_distinct", "false", "func",
+    "into",    "let", "max",  "min",   "module",         "null",  "prql",
+    "stddev",  "sum", "true", "type",
+
+    nullptr,
 };
 
 std::string
@@ -1321,6 +1310,9 @@ prql_keyword_re()
     bool first = true;
 
     for (const char* kw : prql_keywords) {
+        if (kw == nullptr) {
+            break;
+        }
         if (!first) {
             retval.append("|");
         } else {
@@ -1342,6 +1334,9 @@ prql_transform_re()
     bool first = true;
 
     for (const char* kw : prql_transforms) {
+        if (kw == nullptr) {
+            break;
+        }
         if (!first) {
             retval.append("|");
         } else {

src/view_helpers.cc

@@ -665,18 +665,18 @@ layout_views()
     int preview_height0 = lnav_data.ld_preview_hidden
         ? 0
         : lnav_data.ld_preview_view[0].get_inner_height();
-    if (preview_height0
+    if (!lnav_data.ld_preview_hidden
         && lnav_data.ld_preview_view[0].get_overlay_source() != nullptr)
     {
-        preview_height0 += 1;  // XXX extra height for db overlay
+        preview_height0 = 6;  // XXX extra height for db overlay
     }
     int preview_height1 = lnav_data.ld_preview_hidden
         ? 0
         : lnav_data.ld_preview_view[1].get_inner_height();
-    if (preview_height1
+    if (!lnav_data.ld_preview_hidden
         && lnav_data.ld_preview_view[1].get_overlay_source() != nullptr)
     {
-        preview_height1 += 1;  // XXX extra height for db overlay
+        preview_height1 = 6;  // XXX extra height for db overlay
     }
 
     int match_rows = lnav_data.ld_match_source.text_line_count();

test/expected/expected.am

@@ -592,16 +592,24 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_shlexer.sh_e99fe1cde36b85ebbab86ca820f55ec861cdc20b.out \
     $(srcdir)/%reldir%/test_sql.sh_02def66745b063518473df862987747909f56ccc.err \
     $(srcdir)/%reldir%/test_sql.sh_02def66745b063518473df862987747909f56ccc.out \
+    $(srcdir)/%reldir%/test_sql.sh_09416e332d9b2f76743836b72e71b6e4492e594e.err \
+    $(srcdir)/%reldir%/test_sql.sh_09416e332d9b2f76743836b72e71b6e4492e594e.out \
     $(srcdir)/%reldir%/test_sql.sh_0a5d13b62da4cb66a59a51b0240b5fe0b6036b7e.err \
     $(srcdir)/%reldir%/test_sql.sh_0a5d13b62da4cb66a59a51b0240b5fe0b6036b7e.out \
     $(srcdir)/%reldir%/test_sql.sh_0d46ee142f80f262c8c14a22751571cc567df525.err \
     $(srcdir)/%reldir%/test_sql.sh_0d46ee142f80f262c8c14a22751571cc567df525.out \
     $(srcdir)/%reldir%/test_sql.sh_13429aed81d7edfd47b57e9cdb8a25c43aff35c4.err \
     $(srcdir)/%reldir%/test_sql.sh_13429aed81d7edfd47b57e9cdb8a25c43aff35c4.out \
+    $(srcdir)/%reldir%/test_sql.sh_19c92996bcc884bfdb70e3d24606cf5070556a74.err \
+    $(srcdir)/%reldir%/test_sql.sh_19c92996bcc884bfdb70e3d24606cf5070556a74.out \
     $(srcdir)/%reldir%/test_sql.sh_1cbb81cfe40ee16332c5c775a74d06b945aa65c2.err \
     $(srcdir)/%reldir%/test_sql.sh_1cbb81cfe40ee16332c5c775a74d06b945aa65c2.out \
+    $(srcdir)/%reldir%/test_sql.sh_1f892b85dc9008c7b3bab7fdf8aa372a6d5ae22c.err \
+    $(srcdir)/%reldir%/test_sql.sh_1f892b85dc9008c7b3bab7fdf8aa372a6d5ae22c.out \
     $(srcdir)/%reldir%/test_sql.sh_2532083f215ed44630621f18df3dd7b77c06ae10.err \
     $(srcdir)/%reldir%/test_sql.sh_2532083f215ed44630621f18df3dd7b77c06ae10.out \
+    $(srcdir)/%reldir%/test_sql.sh_26ace94793c68c44801e1ec496e7ab6a02304ce3.err \
+    $(srcdir)/%reldir%/test_sql.sh_26ace94793c68c44801e1ec496e7ab6a02304ce3.out \
     $(srcdir)/%reldir%/test_sql.sh_26c0d94d7837792144f2d0f866fb3c12a0bd410d.err \
     $(srcdir)/%reldir%/test_sql.sh_26c0d94d7837792144f2d0f866fb3c12a0bd410d.out \
     $(srcdir)/%reldir%/test_sql.sh_2959f0c70fca61a07c6c772f193e73022f7794f1.err \
@@ -612,6 +620,8 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_2c60ed41369d667d1e2a563d54f8edf84682e526.out \
     $(srcdir)/%reldir%/test_sql.sh_2cc8a92c6eb73741080b187a2670d309b8171c90.err \
     $(srcdir)/%reldir%/test_sql.sh_2cc8a92c6eb73741080b187a2670d309b8171c90.out \
+    $(srcdir)/%reldir%/test_sql.sh_2ed3f3b18ef4ecc68e4dd3cc8041b61fcf2a59af.err \
+    $(srcdir)/%reldir%/test_sql.sh_2ed3f3b18ef4ecc68e4dd3cc8041b61fcf2a59af.out \
     $(srcdir)/%reldir%/test_sql.sh_2f15b8a38673ac4db45dc6ed2eafe609c332575b.err \
     $(srcdir)/%reldir%/test_sql.sh_2f15b8a38673ac4db45dc6ed2eafe609c332575b.out \
     $(srcdir)/%reldir%/test_sql.sh_31df37f254255115611fc321b63374a2fa4a1cd5.err \
@@ -622,8 +632,12 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_3d77a2092192caf98e141a6039e886ede836f044.out \
     $(srcdir)/%reldir%/test_sql.sh_4090f96ea11a344c1e2939211da778992dab47d8.err \
     $(srcdir)/%reldir%/test_sql.sh_4090f96ea11a344c1e2939211da778992dab47d8.out \
+    $(srcdir)/%reldir%/test_sql.sh_4563a807311d0ce3d1f912843e615a6ca579cffa.err \
+    $(srcdir)/%reldir%/test_sql.sh_4563a807311d0ce3d1f912843e615a6ca579cffa.out \
     $(srcdir)/%reldir%/test_sql.sh_4629b626c65a85d7a5595571e195b67afca272ba.err \
     $(srcdir)/%reldir%/test_sql.sh_4629b626c65a85d7a5595571e195b67afca272ba.out \
+    $(srcdir)/%reldir%/test_sql.sh_4a13356ccbdeb5f73fa063e292b5a6cb25e6c23e.err \
+    $(srcdir)/%reldir%/test_sql.sh_4a13356ccbdeb5f73fa063e292b5a6cb25e6c23e.out \
     $(srcdir)/%reldir%/test_sql.sh_50c0b2c93b646b848a017764bde8a4282c556e2d.err \
     $(srcdir)/%reldir%/test_sql.sh_50c0b2c93b646b848a017764bde8a4282c556e2d.out \
     $(srcdir)/%reldir%/test_sql.sh_528e48a03cdfa7cfbe263a6e22a65606247a8a95.err \
@@ -638,6 +652,8 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_5801770f3e0ecc1d62c7a97116d6da1981bbc7bd.out \
     $(srcdir)/%reldir%/test_sql.sh_5fe26fe4fc22f23f8dbe3a6aab394602886f2971.err \
     $(srcdir)/%reldir%/test_sql.sh_5fe26fe4fc22f23f8dbe3a6aab394602886f2971.out \
+    $(srcdir)/%reldir%/test_sql.sh_61471583c5e2f8ede3a8adefce682c27bf3924c8.err \
+    $(srcdir)/%reldir%/test_sql.sh_61471583c5e2f8ede3a8adefce682c27bf3924c8.out \
     $(srcdir)/%reldir%/test_sql.sh_62eb85c9569e71a630d72065238559528a16114c.err \
     $(srcdir)/%reldir%/test_sql.sh_62eb85c9569e71a630d72065238559528a16114c.out \
     $(srcdir)/%reldir%/test_sql.sh_6ad9d0adf85c36363f6b24f49950dcdc13dd34ab.err \
@@ -658,6 +674,8 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_8ee288f1508eaab0367e465e9f382e848f3282aa.out \
     $(srcdir)/%reldir%/test_sql.sh_9a209f3ee1b1f543ca2587b695d2eb0e63e74c51.err \
     $(srcdir)/%reldir%/test_sql.sh_9a209f3ee1b1f543ca2587b695d2eb0e63e74c51.out \
+    $(srcdir)/%reldir%/test_sql.sh_9aaaa810f883f5dcf8a4d5cda4051fdf4640a65c.err \
+    $(srcdir)/%reldir%/test_sql.sh_9aaaa810f883f5dcf8a4d5cda4051fdf4640a65c.out \
     $(srcdir)/%reldir%/test_sql.sh_9b03e9f7a1bc35e408b3a17ee90cfdadea164df6.err \
     $(srcdir)/%reldir%/test_sql.sh_9b03e9f7a1bc35e408b3a17ee90cfdadea164df6.out \
     $(srcdir)/%reldir%/test_sql.sh_9ceccab07fbf7130bffe3c201c710719e4a3e9af.err \
@@ -666,6 +684,8 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_9e1d05b821822ee40e13fadb24ec558f4bfcff10.out \
     $(srcdir)/%reldir%/test_sql.sh_a6b68b9f0044d18e7fa8f9287ddc9110701edc33.err \
     $(srcdir)/%reldir%/test_sql.sh_a6b68b9f0044d18e7fa8f9287ddc9110701edc33.out \
+    $(srcdir)/%reldir%/test_sql.sh_a7955e89791db9a252d8323436fabc51e2960731.err \
+    $(srcdir)/%reldir%/test_sql.sh_a7955e89791db9a252d8323436fabc51e2960731.out \
     $(srcdir)/%reldir%/test_sql.sh_ae7b1f1684e14bf9c16e0d789257b6ef57cfb2b1.err \
     $(srcdir)/%reldir%/test_sql.sh_ae7b1f1684e14bf9c16e0d789257b6ef57cfb2b1.out \
     $(srcdir)/%reldir%/test_sql.sh_afe9cdc4898df5c4e112c13dfe3db6dc089c0d7c.err \
@@ -676,10 +696,14 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_b2694e4fbecdd128798af25ee0d069e7e35fb499.out \
     $(srcdir)/%reldir%/test_sql.sh_b5aa0561a65de7e8e22085db184c72a94b1a89a9.err \
     $(srcdir)/%reldir%/test_sql.sh_b5aa0561a65de7e8e22085db184c72a94b1a89a9.out \
+    $(srcdir)/%reldir%/test_sql.sh_b9330763dea550bbd006d7ae6ae7ea367f831fa3.err \
+    $(srcdir)/%reldir%/test_sql.sh_b9330763dea550bbd006d7ae6ae7ea367f831fa3.out \
     $(srcdir)/%reldir%/test_sql.sh_bad03a996c0750733ab99c592b9011851f521a69.err \
     $(srcdir)/%reldir%/test_sql.sh_bad03a996c0750733ab99c592b9011851f521a69.out \
     $(srcdir)/%reldir%/test_sql.sh_bd46ca4560f8be6307a914e39539bbac0368080a.err \
     $(srcdir)/%reldir%/test_sql.sh_bd46ca4560f8be6307a914e39539bbac0368080a.out \
+    $(srcdir)/%reldir%/test_sql.sh_c17933125df910588b806a9d07c2655bc71198ef.err \
+    $(srcdir)/%reldir%/test_sql.sh_c17933125df910588b806a9d07c2655bc71198ef.out \
     $(srcdir)/%reldir%/test_sql.sh_c20b0320096342c180146a5d18a6de82319d70b2.err \
     $(srcdir)/%reldir%/test_sql.sh_c20b0320096342c180146a5d18a6de82319d70b2.out \
     $(srcdir)/%reldir%/test_sql.sh_c353ef036c505b75996252138fbd4c8d22e8149c.err \
@@ -694,12 +718,18 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_sql.sh_d4d540f0ef7e34b693fc72078d1cf2e069f86d81.out \
     $(srcdir)/%reldir%/test_sql.sh_dd540973a0dc86320d84706845a15608196ae5be.err \
     $(srcdir)/%reldir%/test_sql.sh_dd540973a0dc86320d84706845a15608196ae5be.out \
+    $(srcdir)/%reldir%/test_sql.sh_e44c0e2834038ec8d9b0b10b993967edb711c03c.err \
+    $(srcdir)/%reldir%/test_sql.sh_e44c0e2834038ec8d9b0b10b993967edb711c03c.out \
     $(srcdir)/%reldir%/test_sql.sh_e70dc7d2b686c7f91c2b41b10f3920c50f3ea405.err \
     $(srcdir)/%reldir%/test_sql.sh_e70dc7d2b686c7f91c2b41b10f3920c50f3ea405.out \
+    $(srcdir)/%reldir%/test_sql.sh_ef3cecab4ae0b90760f728add5652378e26b2fe6.err \
+    $(srcdir)/%reldir%/test_sql.sh_ef3cecab4ae0b90760f728add5652378e26b2fe6.out \
     $(srcdir)/%reldir%/test_sql.sh_fea98f976873ee7b55e6f322dda42719a19fb3f0.err \
     $(srcdir)/%reldir%/test_sql.sh_fea98f976873ee7b55e6f322dda42719a19fb3f0.out \
     $(srcdir)/%reldir%/test_sql.sh_ff8a978fc0de0fed675a3cd1454cf435a6856fd5.err \
     $(srcdir)/%reldir%/test_sql.sh_ff8a978fc0de0fed675a3cd1454cf435a6856fd5.out \
+    $(srcdir)/%reldir%/test_sql.sh_ffbc3dbf8464455358a77acffa10a8dd8a080374.err \
+    $(srcdir)/%reldir%/test_sql.sh_ffbc3dbf8464455358a77acffa10a8dd8a080374.out \
     $(srcdir)/%reldir%/test_sql_anno.sh_028d5d5af2f3519b59d349d41cb7ecf385253b51.err \
     $(srcdir)/%reldir%/test_sql_anno.sh_028d5d5af2f3519b59d349d41cb7ecf385253b51.out \
     $(srcdir)/%reldir%/test_sql_anno.sh_0a37c43350ddd7a2d0d75695be32fac083ad04a4.err \

test/expected/test_cli.sh_f2e41555f1a5f40f54ce241207af602ed1503a2b.out

@@ -1,2 +1,2 @@
 filepath lines 
-stdin        4 
+stdin        4 

test/expected/test_cmds.sh_1d92c5bc12f5e7aaa6d84c5ed47f0b9f96e36c6a.out

@@ -1,15 +1,8 @@
 [
     {
         "log_line": 0,
-        "log_part": null,
         "log_time": "2009-07-20 22:59:26.000",
-        "log_idle_msecs": 0,
         "log_level": "info",
-        "log_mark": 0,
-        "log_comment": null,
-        "log_tags": null,
-        "log_annotations": null,
-        "log_filters": null,
         "c_ip": "192.168.202.254",
         "cs_method": "GET",
         "cs_referer": "-",
@@ -20,19 +13,19 @@
         "cs_version": "HTTP/1.0",
         "sc_bytes": 134,
         "sc_status": 200,
-        "cs_host": null
-    },
-    {
-        "log_line": 1,
+        "cs_host": null,
         "log_part": null,
-        "log_time": "2009-07-20 22:59:29.000",
-        "log_idle_msecs": 3000,
-        "log_level": "error",
+        "log_idle_msecs": 0,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 1,
+        "log_time": "2009-07-20 22:59:29.000",
+        "log_level": "error",
         "c_ip": "192.168.202.254",
         "cs_method": "GET",
         "cs_referer": "-",
@@ -43,19 +36,19 @@
         "cs_version": "HTTP/1.0",
         "sc_bytes": 46210,
         "sc_status": 404,
-        "cs_host": null
-    },
-    {
-        "log_line": 2,
+        "cs_host": null,
         "log_part": null,
-        "log_time": "2009-07-20 22:59:29.000",
-        "log_idle_msecs": 0,
-        "log_level": "info",
+        "log_idle_msecs": 3000,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 2,
+        "log_time": "2009-07-20 22:59:29.000",
+        "log_level": "info",
         "c_ip": "192.168.202.254",
         "cs_method": "GET",
         "cs_referer": "-",
@@ -66,6 +59,13 @@
         "cs_version": "HTTP/1.0",
         "sc_bytes": 78929,
         "sc_status": 200,
-        "cs_host": null
+        "cs_host": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
+        "log_mark": 0,
+        "log_comment": null,
+        "log_tags": null,
+        "log_annotations": null,
+        "log_filters": null
     }
 ]

test/expected/test_cmds.sh_a00943ef715598c7554b85de8502454e41bb9e28.out

@@ -1,4 +1,4 @@
- Thu Nov 03 09:20:00          1 normal         2 errors         0 warnings         0 marks
- Thu Nov 03 09:45:00          1 normal         0 errors         0 warnings         0 marks
- Fri Feb 03 09:20:00          0 normal         1 errors         0 warnings         0 marks
- Wed Jan 03 09:20:00          1 normal         0 errors         0 warnings         0 marks
+ Thu Nov 03 09:20:00          1 normal         2 errors         0 warnings         0 marks
+ Thu Nov 03 09:45:00          1 normal         0 errors         0 warnings         0 marks
+ Fri Feb 03 09:20:00          0 normal         1 errors         0 warnings         0 marks
+ Wed Jan 03 09:20:00          1 normal         0 errors         0 warnings         0 marks

test/expected/test_cmds.sh_af0fcbd30b3fd0d13477aa3325ef0302052a4d9f.out

@@ -1 +1 @@
- Sat Nov 03 08:00:00          1 normal         0 errors         0 warnings         0 marks
+ Sat Nov 03 08:00:00          1 normal         0 errors         0 warnings         0 marks

test/expected/test_cmds.sh_c7fabc25374ff47c47931f63b1d697061b816a28.out

@@ -1,2 +1,2 @@
- Sat Nov 03 09:20:00          1 normal         2 errors         0 warnings         1 marks
- Sat Nov 03 09:45:00          1 normal         0 errors         0 warnings         0 marks
+ Sat Nov 03 09:20:00          1 normal         2 errors         0 warnings         1 marks
+ Sat Nov 03 09:45:00          1 normal         0 errors         0 warnings         0 marks

test/expected/test_cmds.sh_ccd326da92d1cacda63501cd1a3077381a18e8f2.out

@@ -1 +1 @@
- Sat Nov 03 00:00:00          2 normal         2 errors         0 warnings         0 marks
+ Sat Nov 03 00:00:00          2 normal         2 errors         0 warnings         0 marks

test/expected/test_cmds.sh_dbdd62995fdefc8318053af05a32416eccfa79fc.out

@@ -1 +1 @@
- Sat Nov 03 08:00:00          2 normal         2 errors         0 warnings         0 marks
+ Sat Nov 03 08:00:00          2 normal         2 errors         0 warnings         0 marks

test/expected/test_cmds.sh_eb22c3e94c536a1bfaeae0c40d271b5b4b08f4fc.out

@@ -1,3 +1,3 @@
-{"log_line":0,"log_part":null,"log_time":"2009-07-20 22:59:26.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/cgi/tramp","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":134,"sc_status":200,"cs_host":null}
-{"log_line":1,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":3000,"log_level":"error","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkboot.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":46210,"sc_status":404,"cs_host":null}
-{"log_line":2,"log_part":null,"log_time":"2009-07-20 22:59:29.000","log_idle_msecs":0,"log_level":"info","log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null,"c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkernel.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":78929,"sc_status":200,"cs_host":null}
+{"log_line":0,"log_time":"2009-07-20 22:59:26.000","log_level":"info","c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/cgi/tramp","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":134,"sc_status":200,"cs_host":null,"log_part":null,"log_idle_msecs":0,"log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null}
+{"log_line":1,"log_time":"2009-07-20 22:59:29.000","log_level":"error","c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkboot.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":46210,"sc_status":404,"cs_host":null,"log_part":null,"log_idle_msecs":3000,"log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null}
+{"log_line":2,"log_time":"2009-07-20 22:59:29.000","log_level":"info","c_ip":"192.168.202.254","cs_method":"GET","cs_referer":"-","cs_uri_query":null,"cs_uri_stem":"/vmw/vSphere/default/vmkernel.gz","cs_user_agent":"gPXE/0.9.7","cs_username":"-","cs_version":"HTTP/1.0","sc_bytes":78929,"sc_status":200,"cs_host":null,"log_part":null,"log_idle_msecs":0,"log_mark":0,"log_comment":null,"log_tags":null,"log_annotations":null,"log_filters":null}

test/expected/test_format_loader.sh_15e861d2327512a721fd42ae51dc5427689e0bb6.out

@@ -1,9 +1,9 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters
-0,<NULL>,2016-06-30 12:00:01.000,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>
-1,<NULL>,2016-06-30 12:00:02.000,1000,debug,0,<NULL>,<NULL>,<NULL>,<NULL>
-2,<NULL>,2016-06-30 12:00:03.000,1000,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>
-3,<NULL>,2016-06-30 12:00:04.000,1000,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>
-4,<NULL>,2016-06-30 12:00:05.000,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>
-5,<NULL>,2016-06-30 12:00:06.000,1000,warning,0,<NULL>,<NULL>,<NULL>,<NULL>
-6,<NULL>,2016-06-30 12:00:07.000,1000,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>
-7,<NULL>,2016-06-30 12:00:08.000,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>
+log_line,log_time,log_level,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2016-06-30 12:00:01.000,trace,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2016-06-30 12:00:02.000,debug,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2016-06-30 12:00:03.000,debug2,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+3,2016-06-30 12:00:04.000,debug3,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+4,2016-06-30 12:00:05.000,info,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+5,2016-06-30 12:00:06.000,warning,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+6,2016-06-30 12:00:07.000,fatal,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+7,2016-06-30 12:00:08.000,info,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_json_format.sh_1bb0fd243e916546aea22029245ac590dae17a86.out

@@ -1,14 +1,14 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,@fields/user,@fields/trace#
-0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,steve@example.com,<NULL>
-7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-15,<NULL>,2013-09-06 22:00:59.124,0,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-17,<NULL>,2013-09-06 22:01:49.124,50000,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>
-25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,line:1
+log_line,log_time,log_level,@fields/user,@fields/trace#,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2013-09-06 20:00:48.124,trace,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2013-09-06 20:00:49.124,info,<NULL>,<NULL>,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+4,2013-09-06 22:00:49.124,info,steve@example.com,<NULL>,<NULL>,7200000,0,<NULL>,<NULL>,<NULL>,<NULL>
+7,2013-09-06 22:00:59.124,debug5,<NULL>,<NULL>,<NULL>,10000,0,<NULL>,<NULL>,<NULL>,<NULL>
+9,2013-09-06 22:00:59.124,debug4,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+11,2013-09-06 22:00:59.124,debug3,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+13,2013-09-06 22:00:59.124,debug2,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+15,2013-09-06 22:00:59.124,debug,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+17,2013-09-06 22:01:49.124,stats,<NULL>,<NULL>,<NULL>,50000,0,<NULL>,<NULL>,<NULL>,<NULL>
+19,2013-09-06 22:01:49.124,warning,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+21,2013-09-06 22:01:49.124,error,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+23,2013-09-06 22:01:49.124,critical,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+25,2013-09-06 22:01:49.124,fatal,<NULL>,line:1,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_json_format.sh_40223ac4742883f883ccc61044bfffd6e102cca6.out

@@ -1,207 +1,200 @@
 [
     {
         "log_line": 0,
-        "log_part": null,
         "log_time": "2013-09-06 20:00:48.124",
-        "log_idle_msecs": 0,
         "log_level": "trace",
+        "arr": null,
+        "obj": null,
+        "lvl": "TRACE",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "TRACE",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 2,
-        "log_part": null,
         "log_time": "2013-09-06 20:00:49.124",
-        "log_idle_msecs": 1000,
         "log_level": "info",
+        "arr": null,
+        "obj": null,
+        "lvl": "INFO",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 1000,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "INFO",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 4,
-        "log_part": null,
         "log_time": "2013-09-06 22:00:49.124",
-        "log_idle_msecs": 7200000,
         "log_level": "info",
+        "arr": null,
+        "obj": null,
+        "lvl": "INFO",
+        "user": "steve@example.com",
+        "log_part": null,
+        "log_idle_msecs": 7200000,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "INFO",
-        "user": "steve@example.com"
+        "log_filters": null
     },
     {
         "log_line": 7,
-        "log_part": null,
         "log_time": "2013-09-06 22:00:59.124",
-        "log_idle_msecs": 10000,
         "log_level": "debug5",
+        "arr": null,
+        "obj": null,
+        "lvl": "DEBUG5",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 10000,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "DEBUG5",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 9,
-        "log_part": null,
         "log_time": "2013-09-06 22:00:59.124",
-        "log_idle_msecs": 0,
         "log_level": "debug4",
+        "arr": null,
+        "obj": null,
+        "lvl": "DEBUG4",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "DEBUG4",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 11,
-        "log_part": null,
         "log_time": "2013-09-06 22:00:59.124",
-        "log_idle_msecs": 0,
         "log_level": "debug3",
+        "arr": null,
+        "obj": null,
+        "lvl": "DEBUG3",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "DEBUG3",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 13,
-        "log_part": null,
         "log_time": "2013-09-06 22:00:59.124",
-        "log_idle_msecs": 0,
         "log_level": "debug2",
+        "arr": null,
+        "obj": null,
+        "lvl": "DEBUG2",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "DEBUG2",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 15,
-        "log_part": null,
         "log_time": "2013-09-06 22:01:00.000",
-        "log_idle_msecs": 876,
         "log_level": "debug",
+        "arr": null,
+        "obj": null,
+        "lvl": "DEBUG",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 876,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "DEBUG",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 17,
-        "log_part": null,
         "log_time": "2013-09-06 22:01:49.124",
-        "log_idle_msecs": 49124,
         "log_level": "stats",
+        "arr": null,
+        "obj": null,
+        "lvl": "STATS",
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 49124,
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
-        "arr": null,
-        "obj": null,
-        "lvl": "STATS",
-        "user": null
+        "log_filters": null
     },
     {
         "log_line": 19,
-        "log_part": null,
         "log_time": "2013-09-06 22:01:49.124",
-        "log_idle_msecs": 0,
         "log_level": "warning",
-        "log_mark": 0,
-        "log_comment": null,
-        "log_tags": null,
-        "log_annotations": null,
-        "log_filters": null,
         "arr": null,
         "obj": null,
         "lvl": "WARNING",
-        "user": null
-    },
-    {
-        "log_line": 21,
+        "user": null,
         "log_part": null,
-        "log_time": "2013-09-06 22:01:49.124",
         "log_idle_msecs": 0,
-        "log_level": "error",
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 21,
+        "log_time": "2013-09-06 22:01:49.124",
+        "log_level": "error",
         "arr": null,
         "obj": null,
         "lvl": "ERROR",
-        "user": null
-    },
-    {
-        "log_line": 23,
+        "user": null,
         "log_part": null,
-        "log_time": "2013-09-06 22:01:49.124",
         "log_idle_msecs": 0,
-        "log_level": "critical",
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 23,
+        "log_time": "2013-09-06 22:01:49.124",
+        "log_level": "critical",
         "arr": null,
         "obj": null,
         "lvl": "CRITICAL",
-        "user": null
-    },
-    {
-        "log_line": 25,
+        "user": null,
         "log_part": null,
-        "log_time": "2013-09-06 22:01:49.124",
         "log_idle_msecs": 0,
-        "log_level": "fatal",
         "log_mark": 0,
         "log_comment": null,
         "log_tags": null,
         "log_annotations": null,
-        "log_filters": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 25,
+        "log_time": "2013-09-06 22:01:49.124",
+        "log_level": "fatal",
         "arr": [
             "hi",
             {
@@ -213,6 +206,13 @@
             "field2": 2
         },
         "lvl": "FATAL",
-        "user": null
+        "user": null,
+        "log_part": null,
+        "log_idle_msecs": 0,
+        "log_mark": 0,
+        "log_comment": null,
+        "log_tags": null,
+        "log_annotations": null,
+        "log_filters": null
     }
 ]

test/expected/test_json_format.sh_6fbe20faa161ab9fa77df7568fff84bf3e47e920.out

@@ -1,4 +1,4 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,user,cl
-0,<NULL>,2013-09-06 20:00:49.124,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo
-1,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,steve@example.com,com.exmaple.foo
-3,<NULL>,2013-09-06 22:01:49.124,60000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,com.exmaple.foo
+log_line,log_time,log_level,user,cl,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2013-09-06 20:00:49.124,info,<NULL>,com.exmaple.foo,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2013-09-06 22:00:49.124,info,steve@example.com,com.exmaple.foo,<NULL>,7200000,0,<NULL>,<NULL>,<NULL>,<NULL>
+3,2013-09-06 22:01:49.124,error,<NULL>,com.exmaple.foo,<NULL>,60000,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_json_format.sh_85d03b1b41a7f819af135d2521a8f2c59418e907.out

@@ -1,14 +1,14 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,arr,obj,lvl,user
-0,<NULL>,2013-09-06 20:00:48.124,0,trace,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,TRACE,<NULL>
-2,<NULL>,2013-09-06 20:00:49.124,1000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,<NULL>
-4,<NULL>,2013-09-06 22:00:49.124,7200000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,INFO,steve@example.com
-7,<NULL>,2013-09-06 22:00:59.124,10000,debug5,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG5,<NULL>
-9,<NULL>,2013-09-06 22:00:59.124,0,debug4,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG4,<NULL>
-11,<NULL>,2013-09-06 22:00:59.124,0,debug3,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG3,<NULL>
-13,<NULL>,2013-09-06 22:00:59.124,0,debug2,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG2,<NULL>
-15,<NULL>,2013-09-06 22:01:00.000,876,debug,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,DEBUG,<NULL>
-17,<NULL>,2013-09-06 22:01:49.124,49124,stats,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,STATS,<NULL>
-19,<NULL>,2013-09-06 22:01:49.124,0,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,WARNING,<NULL>
-21,<NULL>,2013-09-06 22:01:49.124,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,ERROR,<NULL>
-23,<NULL>,2013-09-06 22:01:49.124,0,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,CRITICAL,<NULL>
-25,<NULL>,2013-09-06 22:01:49.124,0,fatal,0,<NULL>,<NULL>,<NULL>,<NULL>,"[""hi"", {""sub1"": true}]","{ ""field1"" : ""hi"", ""field2"": 2 }",FATAL,<NULL>
+log_line,log_time,log_level,arr,obj,lvl,user,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2013-09-06 20:00:48.124,trace,<NULL>,<NULL>,TRACE,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2013-09-06 20:00:49.124,info,<NULL>,<NULL>,INFO,<NULL>,<NULL>,1000,0,<NULL>,<NULL>,<NULL>,<NULL>
+4,2013-09-06 22:00:49.124,info,<NULL>,<NULL>,INFO,steve@example.com,<NULL>,7200000,0,<NULL>,<NULL>,<NULL>,<NULL>
+7,2013-09-06 22:00:59.124,debug5,<NULL>,<NULL>,DEBUG5,<NULL>,<NULL>,10000,0,<NULL>,<NULL>,<NULL>,<NULL>
+9,2013-09-06 22:00:59.124,debug4,<NULL>,<NULL>,DEBUG4,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+11,2013-09-06 22:00:59.124,debug3,<NULL>,<NULL>,DEBUG3,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+13,2013-09-06 22:00:59.124,debug2,<NULL>,<NULL>,DEBUG2,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+15,2013-09-06 22:01:00.000,debug,<NULL>,<NULL>,DEBUG,<NULL>,<NULL>,876,0,<NULL>,<NULL>,<NULL>,<NULL>
+17,2013-09-06 22:01:49.124,stats,<NULL>,<NULL>,STATS,<NULL>,<NULL>,49124,0,<NULL>,<NULL>,<NULL>,<NULL>
+19,2013-09-06 22:01:49.124,warning,<NULL>,<NULL>,WARNING,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+21,2013-09-06 22:01:49.124,error,<NULL>,<NULL>,ERROR,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+23,2013-09-06 22:01:49.124,critical,<NULL>,<NULL>,CRITICAL,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+25,2013-09-06 22:01:49.124,fatal,"[""hi"", {""sub1"": true}]","{ ""field1"" : ""hi"", ""field2"": 2 }",FATAL,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_json_format.sh_d0ec34389274affb70a5a76ba4789d51fd60f602.out

@@ -1,4 +1,4 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
-0,<NULL>,2017-03-24 20:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
-1,<NULL>,2017-03-24 20:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
-2,<NULL>,2017-03-24 20:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"
+log_line,log_time,log_level,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2017-03-24 20:06:26.240,info,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2017-03-24 20:12:47.764,critical,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>,<NULL>,381524,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2017-03-24 20:15:31.694,warning,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}",<NULL>,163930,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_json_format.sh_dfff27a651650a04d93de9a06ab5480e94ce3a79.out

@@ -1,4 +1,4 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3
-0,<NULL>,2017-03-24 16:06:26.240,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>
-1,<NULL>,2017-03-24 16:12:47.764,381524,critical,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>
-2,<NULL>,2017-03-24 16:15:31.694,163930,warning,0,<NULL>,<NULL>,<NULL>,<NULL>,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}"
+log_line,log_time,log_level,client_ip,request/method,request/uri,request/size,response/status,response/size,details1,details2,details3,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2017-03-24 16:06:26.240,info,1.1.1.1,GET,/example/uri/5,166,200,443,<NULL>,<NULL>,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2017-03-24 16:12:47.764,critical,1.1.1.1,GET,/example/uri/5,166,500,4433,<NULL>,<NULL>,<NULL>,<NULL>,381524,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2017-03-24 16:15:31.694,warning,1.1.1.1,GET,/example/uri/5,166,400,44345,"{""foo"": ""bar""}","{""foo"": ""bar""}","{""foo"": ""bar""}",<NULL>,163930,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_logfile.sh_c18e14a26d8261c9f72747118a469266121d5459.out

@@ -1,3 +1,3 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters col_0  col_1   
-       0   <NULL> 2021-05-19 08:00:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>     1 /abc/def 
-       2   <NULL> 2021-05-19 08:00:03.000           2000 info             0      <NULL>   <NULL>          <NULL>      <NULL>     3 /ghi/jkl 
+log_line        log_time         log_level col_0  col_1   log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2021-05-19 08:00:01.000 info          1 /abc/def   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       2 2021-05-19 08:00:03.000 info          3 /ghi/jkl   <NULL>           2000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_prql.sh_451e242cdfa2db9005d4fe752a7b05d1ab5cba29.err

@@ -1,9 +1,9 @@
-✘ error: unable to compile PRQL: from db.access_log | take abc
+✘ error: unable to compile PRQL: from db.access_log | take abc
  reason: `take` expected int or range, but found this.access_log.abc
  = note: Error: 
-             ╭─[:57:27]
+             ╭─[:62:27]
              │
-          57 │ from db.access_log | take abc
+          62 │ from db.access_log | take abc
              │                           ─┬─  
              │                            ╰─── `take` expected int or range, but found this.access_log.abc
          ────╯

test/expected/test_prql.sh_45d57a042092ffdcd28ea35a892f02859e78f33d.out

@@ -1,2 +1,2 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters      c_ip       cs_method cs_referer cs_uri_query  cs_uri_stem   cs_user_agent cs_username cs_version sc_bytes sc_status cs_host 
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL> 192.168.202.254 GET       -                <NULL> /vmw/cgi/tramp gPXE/0.9.7    -           HTTP/1.0        134       200  <NULL> 
+log_line        log_time         log_level      c_ip       cs_method cs_referer cs_uri_query  cs_uri_stem   cs_user_agent cs_username cs_version sc_bytes sc_status cs_host log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2009-07-20 22:59:26.000 info      192.168.202.254 GET       -                <NULL> /vmw/cgi/tramp gPXE/0.9.7    -           HTTP/1.0        134       200  <NULL>   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql.sh_09416e332d9b2f76743836b72e71b6e4492e594e.out

@@ -0,0 +1,3 @@
+group_concat(cs_uri_stem),sc_status
+"/vmw/cgi/tramp,/vmw/vSphere/default/vmkernel.gz",200
+/vmw/vSphere/default/vmkboot.gz,404

test/expected/test_sql.sh_13429aed81d7edfd47b57e9cdb8a25c43aff35c4.out

@@ -1,2 +1,2 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters   c_ip    cs_bytes cs_method cs_uri_query   cs_uri_stem   cs_username cs_vars cs_version s_app s_core s_pid s_req s_runtime s_switches s_worker_reqs sc_bytes sc_header_bytes sc_headers sc_status 
-       0   <NULL> 2016-03-13 22:49:12.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL> 127.0.0.1      696 POST            <NULL> /update_metrics                  38 HTTP/1.1   0     3      88185     1     0.129          1             1       47             378          9       200 
+log_line        log_time         log_level   c_ip    cs_bytes cs_method cs_uri_query   cs_uri_stem   cs_username cs_vars cs_version s_app s_core s_pid s_req s_runtime s_switches s_worker_reqs sc_bytes sc_header_bytes sc_headers sc_status log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2016-03-13 22:49:12.000 info      127.0.0.1      696 POST            <NULL> /update_metrics                  38 HTTP/1.1   0     3      88185     1     0.129          1             1       47             378          9       200   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql.sh_19c92996bcc884bfdb70e3d24606cf5070556a74.out

@@ -0,0 +1,46 @@
+[
+    {
+        "log_line": 0,
+        "log_time": "2014-06-15 01:04:52.000",
+        "log_level": "info",
+        "contextid": "82e87195d704585501",
+        "data": "http://localhost:8086|/|<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"s2daac0735bf476f4560aab81104b623bedfb0cbc0\" InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" Version=\"2.0\" IssueInstant=\"2014-06-15T01:04:52Z\" Destination=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"><saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://openam.vagrant.dev/openam</saml:Issuer><samlp:Status xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">\\n<samlp:StatusCode  xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"\\nValue=\"urn:oasis:names:tc:SAML:2.0:status:Success\">\\n</samlp:StatusCode>\\n</samlp:Status><saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"s2a0bee0da937e236167e99b209802056033816ac2\" IssueInstant=\"2014-06-15T01:04:52Z\" Version=\"2.0\">\\n<saml:Issuer>http://openam.vagrant.dev/openam</saml:Issuer><ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\\n<ds:SignedInfo>\\n<ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\n<ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\\n<ds:Reference URI=\"#s2a0bee0da937e236167e99b209802056033816ac2\">\\n<ds:Transforms>\\n<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"/>\\n<ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\n</ds:Transforms>\\n<ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/>\\n<ds:DigestValue>4uSmVzjovUdQd3px/RcnoxQBsqE=</ds:DigestValue>\\n</ds:Reference>\\n</ds:SignedInfo>\\n<ds:SignatureValue>\\nhm/grge36uA6j1OWif2bTcvVTwESjmuJa27NxepW0AiV5YlcsHDl7RAIk6k/CjsSero3bxGbm56m\\nYncOEi9F1Tu7dS0bfx+vhm/kKTPgwZctf4GWn4qQwP+KeoZywbNj9ShsYJ+zPKzXwN4xBSuPjMxP\\nNf5szzjEWpOndQO/uDs=\\n</ds:SignatureValue>\\n<ds:KeyInfo>\\n<ds:X509Data>\\n<ds:X509Certificate>\\nMIICQDCCAakCBEeNB0swDQYJKoZIhvcNAQEEBQAwZzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh\\nbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMQwwCgYDVQQKEwNTdW4xEDAOBgNVBAsTB09w\\nZW5TU08xDTALBgNVBAMTBHRlc3QwHhcNMDgwMTE1MTkxOTM5WhcNMTgwMTEyMTkxOTM5WjBnMQsw\\nCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLU2FudGEgQ2xhcmExDDAK\\nBgNVBAoTA1N1bjEQMA4GA1UECxMHT3BlblNTTzENMAsGA1UEAxMEdGVzdDCBnzANBgkqhkiG9w0B\\nAQEFAAOBjQAwgYkCgYEArSQc/U75GB2AtKhbGS5piiLkmJzqEsp64rDxbMJ+xDrye0EN/q1U5Of+\\nRkDsaN/igkAvV1cuXEgTL6RlafFPcUX7QxDhZBhsYF9pbwtMzi4A4su9hnxIhURebGEmxKW9qJNY\\nJs0Vo5+IgjxuEWnjnnVgHTs1+mq5QYTA7E6ZyL8CAwEAATANBgkqhkiG9w0BAQQFAAOBgQB3Pw/U\\nQzPKTPTYi9upbFXlrAKMwtFf2OW4yvGWWvlcwcNSZJmTJ8ARvVYOMEVNbsT4OFcfu2/PeYoAdiDA\\ncGy/F2Zuj8XJJpuQRSE6PtQqBuDEHjjmOQJ0rV/r8mO1ZCtHRhpZ5zYRjhRC9eCbjx9VrFax0JDC\\n/FfwWigmrW0Y0Q==\\n</ds:X509Certificate>\\n</ds:X509Data>\\n</ds:KeyInfo>\\n</ds:Signature><saml:Subject>\\n<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" NameQualifier=\"http://openam.vagrant.dev/openam\">user@example.com</saml:NameID><saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\">\\n<saml:SubjectConfirmationData InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" NotOnOrAfter=\"2014-06-15T01:14:52Z\" Recipient=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"/></saml:SubjectConfirmation>\\n</saml:Subject><saml:Conditions NotBefore=\"2014-06-15T00:54:52Z\" NotOnOrAfter=\"2014-06-15T01:14:52Z\">\\n<saml:AudienceRestriction>\\n<saml:Audience>http://localhost:8086</saml:Audience>\\n</saml:AudienceRestriction>\\n</saml:Conditions>\\n<saml:AuthnStatement AuthnInstant=\"2014-06-15T01:00:25Z\" SessionIndex=\"s2f9b4d4b453d12b40ef3905cc959cdb40579c2301\"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>",
+        "domain": "dc=openam",
+        "hostname": "192.168.33.1\t",
+        "ipaddr": "Not Available",
+        "loggedby": "cn=dsameuser,ou=DSAME Users,dc=openam",
+        "loginid": "id=openamuser,ou=user,dc=openam",
+        "messageid": "SAML2-37",
+        "modulename": "SAML2.access",
+        "nameid": "user@example.com",
+        "log_part": null,
+        "log_idle_msecs": 0,
+        "log_mark": 0,
+        "log_comment": null,
+        "log_tags": null,
+        "log_annotations": null,
+        "log_filters": null
+    },
+    {
+        "log_line": 1,
+        "log_time": "2014-06-15 01:04:52.000",
+        "log_level": "trace",
+        "contextid": "ec5708a7f199678a01",
+        "data": "vagrant|/",
+        "domain": "dc=openam",
+        "hostname": "127.0.1.1\t",
+        "ipaddr": "Not Available",
+        "loggedby": "cn=dsameuser,ou=DSAME Users,dc=openam",
+        "loginid": "cn=dsameuser,ou=DSAME Users,dc=openam",
+        "messageid": "COT-22",
+        "modulename": "COT.access",
+        "nameid": "Not Available",
+        "log_part": null,
+        "log_idle_msecs": 0,
+        "log_mark": 0,
+        "log_comment": null,
+        "log_tags": null,
+        "log_annotations": null,
+        "log_filters": null
+    }
+]

test/expected/test_sql.sh_1cbb81cfe40ee16332c5c775a74d06b945aa65c2.out

@@ -1,3 +1,3 @@
 id first_name last_name age 
- 0 Phil       Myman      30 
- 1 Lem        Hewitt     35 
+ 0 Phil       Myman      30 
+ 1 Lem        Hewitt     35 

test/expected/test_sql.sh_1f892b85dc9008c7b3bab7fdf8aa372a6d5ae22c.out

@@ -0,0 +1,23 @@
+[
+    {
+        "cs_headers": {
+            "User-Agent": "Mozilla/5.0 (Linux; Android 4.4.4; SM-G900V Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.59 Mobile Safari/537.36",
+            "Referer": "http://example.com/Search/SearchResults.pg?informationRecipient.languageCode.c=en",
+            "Host": "xzy.example.com"
+        }
+    },
+    {
+        "cs_headers": {
+            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36",
+            "Referer": null,
+            "Host": "example.hello.com"
+        }
+    },
+    {
+        "cs_headers": {
+            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36",
+            "Referer": null,
+            "Host": "hello.example.com"
+        }
+    }
+]

test/expected/test_sql.sh_26ace94793c68c44801e1ec496e7ab6a02304ce3.out

@@ -0,0 +1,2 @@
+name,content,length(content)
+logfile_empty.0,,0

test/expected/test_sql.sh_2ed3f3b18ef4ecc68e4dd3cc8041b61fcf2a59af.out

@@ -0,0 +1,5 @@
+log_line,log_time,log_level,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2007-11-03 09:23:38.000,error,veridian,<NULL>,7998,<NULL>,automount,<NULL>,automount[7998],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2007-11-03 09:23:38.000,info,veridian,<NULL>,16442,<NULL>,automount,<NULL>,automount[16442],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2007-11-03 09:23:38.000,error,veridian,<NULL>,7999,<NULL>,automount,<NULL>,automount[7999],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+3,2007-11-03 09:47:02.000,info,veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>,<NULL>,1404000,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql.sh_2f15b8a38673ac4db45dc6ed2eafe609c332575b.out

@@ -1,3 +1,3 @@
 id first_name last_name age 
- 0 Phil       Myman      30 
- 1 Lem        Hewitt     35 
+ 0 Phil       Myman      30 
+ 1 Lem        Hewitt     35 

test/expected/test_sql.sh_4563a807311d0ce3d1f912843e615a6ca579cffa.out

@@ -0,0 +1,40 @@
+[
+    {
+        "fields": {
+            "namespace": "inc-1-enh-domain-c14-ns-2",
+            "pod": "hello-inc-1-enh-domain-c14-ns-2-3-d8f465685-k75gp",
+            "reason": "",
+            "status": "Pending"
+        }
+    },
+    {
+        "fields": {
+            "error": "pod inc-1-domain-c14-ns-6/fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b is not found: PodNotFound",
+            "namespace": "inc-1-domain-c14-ns-6",
+            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
+            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
+        }
+    },
+    {
+        "fields": {
+            "namespace": "inc-1-domain-c14-ns-6",
+            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
+            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
+        }
+    },
+    {
+        "fields": {
+            "namespace": "inc-1-domain-c14-ns-6",
+            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
+            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
+        }
+    },
+    {
+        "fields": {
+            "namespace": "inc-1-enh-domain-c14-ns-2",
+            "pod": "hello-inc-1-enh-domain-c14-ns-2-7-5ddd6bcd69-6rqct",
+            "reason": "",
+            "status": "Pending"
+        }
+    }
+]

test/expected/test_sql.sh_4a13356ccbdeb5f73fa063e292b5a6cb25e6c23e.out

@@ -0,0 +1,2 @@
+log_line,log_time,log_level,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+118,2011-11-03 00:19:49.337,error,1320279589.337053,CBHHuR1xFnm5C5CQBc,192.168.2.76,52074,74.125.225.76,80,1,GET,i4.ytimg.com,/vi/gDbg_GeuiSY/hqdefault.jpg,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,893,404,Not Found,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F2GiAw3j1m22R2yIg2,<NULL>,image/jpeg,<NULL>,18,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql.sh_5532c7a21e3f6b7df3aad10d7bdfbb7a812ae6c7.out

@@ -1,2 +1,2 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,col_0,TTY,PWD,USER,COMMAND
-0,<NULL>,2007-11-03 09:47:02.000,0,info,0,<NULL>,<NULL>,<NULL>,[1],veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>,timstack,pts/6,/auto/wstimstack/rpms/lbuild/test,root,/usr/bin/tail /var/log/messages
+log_line,log_time,log_level,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,col_0,TTY,PWD,USER,COMMAND,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2007-11-03 09:47:02.000,info,veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>,timstack,pts/6,/auto/wstimstack/rpms/lbuild/test,root,/usr/bin/tail /var/log/messages,<NULL>,0,0,<NULL>,<NULL>,<NULL>,[1]

test/expected/test_sql.sh_61471583c5e2f8ede3a8adefce682c27bf3924c8.out

@@ -0,0 +1,11 @@
+[
+    {
+        "sc_substatus": 0
+    },
+    {
+        "sc_substatus": 0
+    },
+    {
+        "sc_substatus": null
+    }
+]

test/expected/test_sql.sh_7593b39f4be6fd2124ec7cf10835ee015d475b16.out

@@ -1,2 +1,2 @@
 log_top_line() log_msg_line() 
-             2              2 
+             2              2 

test/expected/test_sql.sh_9aaaa810f883f5dcf8a4d5cda4051fdf4640a65c.out

@@ -0,0 +1,4 @@
+log_line,log_time,log_level,log_msg_format,log_msg_values,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters,log_msg_schema
+0,2015-11-03 09:23:38.000,info,# is up,"{""col_0"":""eth0""}",<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,ce6143108d22799c9c7a994e21e7302e
+1,2015-11-03 09:23:38.000,info,# is up,"{""col_0"":""eth1""}",<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,ce6143108d22799c9c7a994e21e7302e
+2,2015-11-03 09:23:38.000,info,# is down,"{""col_0"":""eth0""}",<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,83cd119b5b6f7e79abff4d28946b7a61

test/expected/test_sql.sh_a7955e89791db9a252d8323436fabc51e2960731.out

@@ -0,0 +1,3 @@
+log_line,log_time,log_level,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+1,2015-03-24 14:02:50.000,info,127.0.0.1,GET,<NULL>,<NULL>,/includes/js/combined-javascript.js,<NULL>,-,HTTP/1.1,65508,200,<NULL>,<NULL>,6927348000,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2015-03-24 14:02:50.000,error,127.0.0.1,GET,<NULL>,<NULL>,/bad.foo,<NULL>,-,HTTP/1.1,65508,404,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql.sh_b9330763dea550bbd006d7ae6ae7ea367f831fa3.out

@@ -0,0 +1,10 @@
+node_text
+"Gambardella, Matthew"
+"Ralls, Kim"
+"Corets, Eva"
+"Randall, Cynthia"
+"Thurman, Paula"
+"Knorr, Stefan"
+"Kress, Peter"
+"O'Brien, Tim"
+"Galos, Mike"

test/expected/test_sql.sh_bad03a996c0750733ab99c592b9011851f521a69.out

@@ -1,5 +1,5 @@
 match_index   content                                case match_index when 2 then replicate('abc', 1000) else '' end                              
-          0 {"col_0":10}                                                                                                                          
-          1 {"col_0":50}                                                                                                                          
-          2 {"col_0":50} abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc⋯bcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc 
-          3 {"col_0":50}                                                                                                                          
+          0 {"col_0":10}                                                                                                                          
+          1 {"col_0":50}                                                                                                                          
+          2 {"col_0":50} abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc⋯bcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc 
+          3 {"col_0":50}                                                                                                                          

test/expected/test_sql.sh_c17933125df910588b806a9d07c2655bc71198ef.out

@@ -0,0 +1,6 @@
+log_line,log_time,log_level,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2011-11-03 00:19:26.452,info,1320279566.452687,CwFs1P2UcUdlSxD2La,192.168.2.76,52026,132.235.215.119,80,1,GET,www.reddit.com,/,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,109978,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Ftw3fJ2JJF3ntMTL2,<NULL>,text/html,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2011-11-03 00:19:26.831,info,1320279566.831619,CJxSUgkInyKSHiju1,192.168.2.76,52030,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/E-pbDbmiBclPkDaX.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2300,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FFTf9Zdgk3YkfCKo3,<NULL>,image/jpeg,<NULL>,379,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2011-11-03 00:19:26.831,info,1320279566.831563,CJwUi9bdB9c1lLW44,192.168.2.76,52029,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/BP5bQfy4o-C7cF6A.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2272,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FfXtOj3o7aub4vbs2j,<NULL>,image/jpeg,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+3,2011-11-03 00:19:26.831,info,1320279566.831473,CoX7zA3OJKGUOSCBY2,192.168.2.76,52027,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/SVUtep3Rhg5FTRn4.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2562,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F21Ybs3PTqS6O4Q2Zh,<NULL>,image/jpeg,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+4,2011-11-03 00:19:26.831,info,1320279566.831643,CT0JIh479jXIGt0Po1,192.168.2.76,52031,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/uuy31444rLSyKdHS.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,1595,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Fdk0MZ1wQmKWAJ4WH4,<NULL>,image/jpeg,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql.sh_d4d540f0ef7e34b693fc72078d1cf2e069f86d81.out

@@ -1,4 +1,4 @@
 total log_line        log_time         duration log_formats                     log_msg_format                      
-    2        0 2007-04-28 06:53:55.000          syslog_log  New relevant interface # for #                          
-    2        1 2007-04-28 06:53:55.000          syslog_log  Joining # multicast group on interface # with address # 
-    2        2 2007-04-28 06:53:55.000          syslog_log  Registering new address record for # on #               
+    2        0 2007-04-28 06:53:55.000          syslog_log  New relevant interface # for #                          
+    2        1 2007-04-28 06:53:55.000          syslog_log  Joining # multicast group on interface # with address # 
+    2        2 2007-04-28 06:53:55.000          syslog_log  Registering new address record for # on #               

test/expected/test_sql.sh_e44c0e2834038ec8d9b0b10b993967edb711c03c.out

@@ -0,0 +1,11 @@
+duration,bro_uid,req
+116.438679,CwFs1P2UcUdlSxD2La,GET www.reddit.com
+115.202498,CdZUPH2DKOE7zzCLE3,GET feeds.bbci.co.uk
+115.121914,CdrfXZ1NOFPEawF218,GET c.thumbs.redditmedia.com
+115.121837,CoX7zA3OJKGUOSCBY2,GET e.thumbs.redditmedia.com
+115.12181,CJxSUgkInyKSHiju1,GET e.thumbs.redditmedia.com
+115.121506,CT0JIh479jXIGt0Po1,GET f.thumbs.redditmedia.com
+115.121339,CJwUi9bdB9c1lLW44,GET f.thumbs.redditmedia.com
+115.119217,C6Q4Vm14ZJIlZhsXqk,GET a.thumbs.redditmedia.com
+72.274459,CbNCgO1MzloHRNeY4f,GET www.google.com
+71.658218,CnGze54kQWWpKqrrZ4,GET ajax.googleapis.com

test/expected/test_sql.sh_ef3cecab4ae0b90760f728add5652378e26b2fe6.out

@@ -0,0 +1,2 @@
+log_line,log_time,log_level,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+1,2009-07-20 22:59:29.000,error,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>,<NULL>,3000,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql.sh_ffbc3dbf8464455358a77acffa10a8dd8a080374.out

@@ -0,0 +1,4 @@
+log_line,log_time,log_level,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters
+0,2009-07-20 22:59:26.000,info,192.168.202.254,GET,-,<NULL>,/vmw/cgi/tramp,gPXE/0.9.7,-,HTTP/1.0,134,200,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>
+1,2009-07-20 22:59:29.000,error,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>,<NULL>,3000,0,<NULL>,<NULL>,<NULL>,<NULL>
+2,2009-07-20 22:59:29.000,info,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkernel.gz,gPXE/0.9.7,-,HTTP/1.0,78929,200,<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>

test/expected/test_sql_indexes.sh_1614ebb5e2e83bab11023354dea8a0885ddf64b4.out

@@ -1,3 +1,3 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_msg_values 
-       1   <NULL> 2009-07-20 22:59:29.000           3000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       3   <NULL> 2013-02-15 06:00:31.000   112777262000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
+log_line        log_time         log_level log_msg_format log_msg_values log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       1 2009-07-20 22:59:29.000 error                    null             <NULL>           3000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       3 2013-02-15 06:00:31.000 error                    null             <NULL>   112777262000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_indexes.sh_2b4945247332d01b08e6f17340f7d17f3b3649b8.out

@@ -1,5 +1,5 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_msg_values 
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       1   <NULL> 2009-07-20 22:59:29.000           3000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       2   <NULL> 2009-07-20 22:59:29.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       3   <NULL> 2013-02-15 06:00:31.000   112777262000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
+log_line        log_time         log_level log_msg_format log_msg_values log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2009-07-20 22:59:26.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       1 2009-07-20 22:59:29.000 error                    null             <NULL>           3000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       2 2009-07-20 22:59:29.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       3 2013-02-15 06:00:31.000 error                    null             <NULL>   112777262000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_indexes.sh_541a8e35f34a206e340a3880128b6ce137847872.out

@@ -1,5 +1,5 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters      c_ip       cs_method cs_referer cs_uri_query           cs_uri_stem            cs_user_agent cs_username cs_version sc_bytes sc_status cs_host   log_unique_path    
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL> 192.168.202.254 GET       -                <NULL> /vmw/cgi/tramp                   gPXE/0.9.7    -           HTTP/1.0        134       200  <NULL> logfile_access_log.0 
-       1   <NULL> 2009-07-20 22:59:29.000           3000 error            0      <NULL>   <NULL>          <NULL>      <NULL> 192.168.202.254 GET       -                <NULL> /vmw/vSphere/default/vmkboot.gz  gPXE/0.9.7    -           HTTP/1.0      46210       404  <NULL> logfile_access_log.0 
-       2   <NULL> 2009-07-20 22:59:29.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL> 192.168.202.254 GET       -                <NULL> /vmw/vSphere/default/vmkernel.gz gPXE/0.9.7    -           HTTP/1.0      78929       200  <NULL> logfile_access_log.0 
-       3   <NULL> 2013-02-15 06:00:31.000   112777262000 error            0      <NULL>   <NULL>          <NULL>      <NULL> 10.112.81.15    <NULL>    -                <NULL> <NULL>                           -             -           <NULL>            0       400  <NULL> logfile_access_log.1 
+log_line        log_time         log_level      c_ip       cs_method cs_referer cs_uri_query           cs_uri_stem            cs_user_agent cs_username cs_version sc_bytes sc_status cs_host log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters   log_unique_path    
+       0 2009-07-20 22:59:26.000 info      192.168.202.254 GET       -                <NULL> /vmw/cgi/tramp                   gPXE/0.9.7    -           HTTP/1.0        134       200  <NULL>   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> logfile_access_log.0 
+       1 2009-07-20 22:59:29.000 error     192.168.202.254 GET       -                <NULL> /vmw/vSphere/default/vmkboot.gz  gPXE/0.9.7    -           HTTP/1.0      46210       404  <NULL>   <NULL>           3000        0      <NULL>   <NULL>          <NULL>      <NULL> logfile_access_log.0 
+       2 2009-07-20 22:59:29.000 info      192.168.202.254 GET       -                <NULL> /vmw/vSphere/default/vmkernel.gz gPXE/0.9.7    -           HTTP/1.0      78929       200  <NULL>   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> logfile_access_log.0 
+       3 2013-02-15 06:00:31.000 error     10.112.81.15    <NULL>    -                <NULL> <NULL>                           -             -           <NULL>            0       400  <NULL>   <NULL>   112777262000        0      <NULL>   <NULL>          <NULL>      <NULL> logfile_access_log.1 

test/expected/test_sql_indexes.sh_59a1497c13a5e09bc8f95ef02552b2835ebea6e5.out

@@ -1,2 +1,2 @@
 $id $parent $notused                 replace($detail, 'SCAN TABLE', 'SCAN')                  
-  2       0        0 SCAN all_logs VIRTUAL TABLE INDEX 1:SEARCH all_logs USING log_level < ? 
+  2       0        0 SCAN all_logs VIRTUAL TABLE INDEX 1:SEARCH all_logs USING log_level < ? 

test/expected/test_sql_indexes.sh_69fd19d56a8cd1fc9c7eb9351270eabb491f8233.out

@@ -1,5 +1,5 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_msg_values log_format 
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           access_log 
-       1   <NULL> 2009-07-20 22:59:29.000           3000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           access_log 
-       2   <NULL> 2009-07-20 22:59:29.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           access_log 
-       3   <NULL> 2013-02-15 06:00:31.000   112777262000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           access_log 
+log_line        log_time         log_level log_msg_format log_msg_values log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters log_format 
+       0 2009-07-20 22:59:26.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> access_log 
+       1 2009-07-20 22:59:29.000 error                    null             <NULL>           3000        0      <NULL>   <NULL>          <NULL>      <NULL> access_log 
+       2 2009-07-20 22:59:29.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> access_log 
+       3 2013-02-15 06:00:31.000 error                    null             <NULL>   112777262000        0      <NULL>   <NULL>          <NULL>      <NULL> access_log 

test/expected/test_sql_indexes.sh_6f707b6e856dbaab6f95e7e89b98dc3652021f85.out

@@ -1,3 +1,3 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_msg_values 
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       2   <NULL> 2009-07-20 22:59:29.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
+log_line        log_time         log_level log_msg_format log_msg_values log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2009-07-20 22:59:26.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       2 2009-07-20 22:59:29.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_indexes.sh_b615b6737b1e0d383c8ce4a1db56332f11dbc158.out

@@ -1,2 +1,2 @@
 $id $parent $notused                  replace($detail, 'SCAN TABLE', 'SCAN')                  
-  2       0        0 SCAN all_logs VIRTUAL TABLE INDEX 1:SEARCH all_logs USING log_format = ? 
+  2       0        0 SCAN all_logs VIRTUAL TABLE INDEX 1:SEARCH all_logs USING log_format = ? 

test/expected/test_sql_indexes.sh_dab07d8de7728752ae938a174468d75e85f3ae7e.out

@@ -1,2 +1,2 @@
 $id $parent $notused                    replace($detail, 'SCAN TABLE', 'SCAN')                     
-  2       0        0 SCAN access_log VIRTUAL TABLE INDEX 1:SEARCH access_log USING log_path GLOB ? 
+  2       0        0 SCAN access_log VIRTUAL TABLE INDEX 1:SEARCH access_log USING log_path GLOB ? 

test/expected/test_sql_indexes.sh_f7681c234d4f60df16c997a05163aeb058c52870.out

@@ -1,5 +1,5 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters log_msg_format log_msg_values 
-       0   <NULL> 2009-07-20 22:59:26.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       1   <NULL> 2009-07-20 22:59:29.000           3000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       2   <NULL> 2009-07-20 22:59:29.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>                null           
-       3   <NULL> 2013-02-15 06:00:31.000   112777262000 error            0      <NULL>   <NULL>          <NULL>      <NULL>                null           
+log_line        log_time         log_level log_msg_format log_msg_values log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2009-07-20 22:59:26.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       1 2009-07-20 22:59:29.000 error                    null             <NULL>           3000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       2 2009-07-20 22:59:29.000 info                     null             <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       3 2013-02-15 06:00:31.000 error                    null             <NULL>   112777262000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_regexp.sh_51293df041b6969ccecc60204dce3676d0fb006d.out

@@ -1,2 +1,2 @@
 match_index          content           
-          0 {"key":"foo","value":4670} 
+          0 {"key":"foo","value":4670} 

test/expected/test_sql_regexp.sh_b841a0c09601e2419eeb99e85f7e286c889e4801.out

@@ -1,27 +1,27 @@
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,match_index,content
-2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.cdscheduler""}"
-2,<NULL>,2022-08-16 00:32:15.000,199000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
-5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.install""}"
-5,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/asl""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
-8,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" sharing output destination ""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,2,"{""value"":""/var/log/system.log""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,3,"{""value"":"" with ASL Module ""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,4,"{""value"":""com.apple.asl""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,6,"{""value"":""com.apple.asl""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,8,"{""value"":""com.apple.authd""}"
-11,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,9,"{""value"":"".""}"
-14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,0,"{""value"":""com.apple.authd""}"
-14,<NULL>,2022-08-16 00:32:15.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
+log_line,log_time,log_level,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version,log_part,log_idle_msecs,log_mark,log_comment,log_tags,log_annotations,log_filters,match_index,content
+2,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,199000,0,<NULL>,<NULL>,<NULL>,<NULL>,0,"{""value"":""com.apple.cdscheduler""}"
+2,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,199000,0,<NULL>,<NULL>,<NULL>,<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
+5,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,0,"{""value"":""com.apple.install""}"
+5,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,0,"{""value"":""com.apple.authd""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,1,"{""value"":"" sharing output destination ""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,2,"{""value"":""/var/log/asl""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,3,"{""value"":"" with ASL Module ""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,4,"{""value"":""com.apple.asl""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,6,"{""value"":""com.apple.asl""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,8,"{""value"":""com.apple.authd""}"
+8,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,9,"{""value"":"".""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,0,"{""value"":""com.apple.authd""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,1,"{""value"":"" sharing output destination ""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,2,"{""value"":""/var/log/system.log""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,3,"{""value"":"" with ASL Module ""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,4,"{""value"":""com.apple.asl""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,5,"{""value"":"".\n\tOutput parameters from ASL Module ""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,6,"{""value"":""com.apple.asl""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,7,"{""value"":"" override any specified in ASL Module ""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,8,"{""value"":""com.apple.authd""}"
+11,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,9,"{""value"":"".""}"
+14,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,0,"{""value"":""com.apple.authd""}"
+14,2022-08-16 00:32:15.000,info,Tims-Air,<NULL>,314,<NULL>,syslogd,<NULL>,syslogd[314],<NULL>,<NULL>,0,0,<NULL>,<NULL>,<NULL>,<NULL>,1,"{""value"":"" claims selected messages.\n\tThose messages may not appear in standard system log files or in the ASL database.""}"

test/expected/test_sql_search_table.sh_1a0d872ebc492fcecb2e79a0993170d5fc771a5b.out

@@ -1,2 +1,2 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  comp   opid    tid   user   file   item   line  prc  reason  req    sid         src        sub   vpxa_update match_index   lro_id       entity                 operation                           SessionId                           SessionSubId             
-       2   <NULL> 2022-06-02 11:58:12.376            182 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> e3979f6 45709 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846064 SessionManager vim.SessionManager.sessionIsActive 52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866 
+log_line        log_time         log_level  comp   opid    tid   user   file   item   line  prc  reason  req    sid         src        sub   vpxa_update match_index   lro_id       entity                 operation                           SessionId                           SessionSubId             log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       2 2022-06-02 11:58:12.376 info      <NULL> e3979f6 45709 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846064 SessionManager vim.SessionManager.sessionIsActive 52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866   <NULL>            182        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_search_table.sh_3f5f74863d065418bca5a000e6ad3d9344635164.out

@@ -1,12 +1,12 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index         name          
-       2   <NULL> 2022-08-16 00:32:15.000         199000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 com.apple.cdscheduler 
-       5   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 com.apple.install     
-       8   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 com.apple.authd       
-       8   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 com.apple.asl         
-       8   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           2 com.apple.asl         
-       8   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           3 com.apple.authd       
-      11   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 com.apple.authd       
-      11   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 com.apple.asl         
-      11   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           2 com.apple.asl         
-      11   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           3 com.apple.authd       
-      14   <NULL> 2022-08-16 00:32:15.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 com.apple.authd       
+log_line        log_time         log_level match_index         name          log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       2 2022-08-16 00:32:15.000 info                0 com.apple.cdscheduler   <NULL>         199000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       5 2022-08-16 00:32:15.000 info                0 com.apple.install       <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       8 2022-08-16 00:32:15.000 info                0 com.apple.authd         <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       8 2022-08-16 00:32:15.000 info                1 com.apple.asl           <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       8 2022-08-16 00:32:15.000 info                2 com.apple.asl           <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       8 2022-08-16 00:32:15.000 info                3 com.apple.authd         <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      11 2022-08-16 00:32:15.000 info                0 com.apple.authd         <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      11 2022-08-16 00:32:15.000 info                1 com.apple.asl           <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      11 2022-08-16 00:32:15.000 info                2 com.apple.asl           <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      11 2022-08-16 00:32:15.000 info                3 com.apple.authd         <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      14 2022-08-16 00:32:15.000 info                0 com.apple.authd         <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_search_table.sh_5aaae556ecb1661602f176215e28f661d3404032.out

@@ -1,4 +1,4 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index user  ppid  pid cpu_pct mem_pct vsz rss tty stat start_time cpu_time maj_flt min_flt    cmd      cmd_name  cmd_args 
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL> 
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL> 
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL> 
+log_line        log_time         log_level match_index user  ppid  pid cpu_pct mem_pct vsz rss tty stat start_time cpu_time maj_flt min_flt    cmd      cmd_name  cmd_args log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2022-06-02 00:01:01.000 info                1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL>   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL>   <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                1 root <NULL>   2       0       0   0   0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd] [kthreadd]   <NULL>   <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_search_table.sh_df0fd242f57a96d40f466493938cda0789a094fa.out

@@ -1,24 +1,24 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters match_index user  ppid  pid cpu_pct mem_pct  vsz   rss  tty stat start_time cpu_time maj_flt min_flt                              cmd                                      cmd_name                        cmd_args                  
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16 
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                    
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                    
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                    
-       0   <NULL> 2022-06-02 00:01:01.000              0 info             0      <NULL>   <NULL>          <NULL>      <NULL>           4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16 
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           5 root <NULL>   8       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [mm_percpu_wq]                                                 [mm_percpu_wq]         <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           6 root <NULL>   9       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [ksoftirqd/0]                                                  [ksoftirqd/0]          <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           7 root <NULL>  10       0       0      0    0 ?   I    Jun01      0:23      <NULL>  <NULL> [rcu_sched]                                                    [rcu_sched]            <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           8 root <NULL>  11       0       0      0    0 ?   I    Jun01      0:00      <NULL>  <NULL> [rcu_bh]                                                       [rcu_bh]               <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           9 root <NULL>  12       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [migration/0]                                                  [migration/0]          <NULL>                                    
-      12   <NULL> 2022-06-02 00:02:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>          10 root <NULL>  14       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [cpuhp/0]                                                      [cpuhp/0]              <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16 
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           5 root <NULL>   8       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [mm_percpu_wq]                                                 [mm_percpu_wq]         <NULL>                                    
-      30   <NULL> 2022-06-02 00:03:01.000          60000 info             0      <NULL>   <NULL>          <NULL>      <NULL>           6 root <NULL>   9       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [ksoftirqd/0]                                                  [ksoftirqd/0]          <NULL>                                    
+log_line        log_time         log_level match_index user  ppid  pid cpu_pct mem_pct  vsz   rss  tty stat start_time cpu_time maj_flt min_flt                              cmd                                      cmd_name                        cmd_args                  log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters 
+       0 2022-06-02 00:01:01.000 info                0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       0 2022-06-02 00:01:01.000 info                1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                      <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       0 2022-06-02 00:01:01.000 info                2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                      <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       0 2022-06-02 00:01:01.000 info                3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                      <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+       0 2022-06-02 00:01:01.000 info                4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                      <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16   <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                5 root <NULL>   8       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [mm_percpu_wq]                                                 [mm_percpu_wq]         <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                6 root <NULL>   9       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [ksoftirqd/0]                                                  [ksoftirqd/0]          <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                7 root <NULL>  10       0       0      0    0 ?   I    Jun01      0:23      <NULL>  <NULL> [rcu_sched]                                                    [rcu_sched]            <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                8 root <NULL>  11       0       0      0    0 ?   I    Jun01      0:00      <NULL>  <NULL> [rcu_bh]                                                       [rcu_bh]               <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info                9 root <NULL>  12       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [migration/0]                                                  [migration/0]          <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      12 2022-06-02 00:02:01.000 info               10 root <NULL>  14       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [cpuhp/0]                                                      [cpuhp/0]              <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                0 root <NULL>   1       0       0 158392 7792 ?   Ss   Jun01      0:14      <NULL>  <NULL> /lib/systemd/systemd --switched-root --system --deserialize 16 /lib/systemd/systemd   --switched-root --system --deserialize 16   <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                1 root <NULL>   2       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [kthreadd]                                                     [kthreadd]             <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                2 root <NULL>   3       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_gp]                                                       [rcu_gp]               <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                3 root <NULL>   4       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [rcu_par_gp]                                                   [rcu_par_gp]           <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                4 root <NULL>   6       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [kworker/0:0H-kblockd]                                         [kworker/0:0H-kblockd] <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                5 root <NULL>   8       0       0      0    0 ?   I<   Jun01      0:00      <NULL>  <NULL> [mm_percpu_wq]                                                 [mm_percpu_wq]         <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 
+      30 2022-06-02 00:03:01.000 info                6 root <NULL>   9       0       0      0    0 ?   S    Jun01      0:00      <NULL>  <NULL> [ksoftirqd/0]                                                  [ksoftirqd/0]          <NULL>                                      <NULL>          60000        0      <NULL>   <NULL>          <NULL>      <NULL> 

test/expected/test_sql_search_table.sh_ef9373a76853f345d06234f6e0fe11b5d40da27b.out

@@ -1,6 +1,6 @@
-log_line log_part        log_time         log_idle_msecs log_level log_mark log_comment log_tags log_annotations log_filters  comp             opid              tid   user   file   item   line  prc  reason  req    sid         src        sub   vpxa_update match_index   lro_id         entity                       operation                              SessionId                           SessionSubId                                                                     log_body                                                         
-       0   <NULL> 2022-06-02 11:58:12.193              0 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> 7e1280cf                    45715 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846063 SessionManager     vim.SessionManager.sessionIsActive        528e6e0c-246d-58b5-3234-278c6e0c5d0d 52c289ac-2563-48d5-8a8e-f178da022c0d [VpxLRO] -- BEGIN lro-846063 -- SessionManager -- vim.Sessio⋯8b5-3234-278c6e0c5d0d(52c289ac-2563-48d5-8a8e-f178da022c0d) 
-       2   <NULL> 2022-06-02 11:58:12.376            182 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> e3979f6                     45709 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846064 SessionManager     vim.SessionManager.sessionIsActive        52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866 [VpxLRO] -- BEGIN lro-846064 -- SessionManager -- vim.Sessio⋯287-b4e4-344192c6a01d(523e0a4b-6e83-6bcd-9342-22502dd89866) 
-       4   <NULL> 2022-06-02 11:58:12.623            246 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> l3wrhr4o-cbf-h5:70001034-60 47524 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846066 ChangeLogCollector vim.cdc.ChangeLogCollector.waitForChanges 526861fc-0c28-1930-ae5e-d8c2772bf8c2 52a7a308-9646-c054-f1e7-16131c1a7db6 [VpxLRO] -- BEGIN lro-846066 -- ChangeLogCollector -- vim.c⋯1930-ae5e-d8c2772bf8c2(52a7a308-9646-c054-f1e7-16131c1a7db6) 
-       6   <NULL> 2022-06-02 11:58:12.736            113 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> 499b440                     48432 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846067 SessionManager     vim.SessionManager.sessionIsActive        521fe9f6-d061-11a2-ac86-badb3c071373 524cba9b-2cc4-9b70-32e4-421452a404d7 [VpxLRO] -- BEGIN lro-846067 -- SessionManager -- vim.Sessio⋯1a2-ac86-badb3c071373(524cba9b-2cc4-9b70-32e4-421452a404d7) 
-       8   <NULL> 2022-06-02 11:58:12.740              4 info             0      <NULL>   <NULL>          <NULL>      <NULL> <NULL> 55a419df                    48035 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846068 SessionManager     vim.SessionManager.sessionIsActive        52585600-b0bc-76b1-c4d5-4d7708671c5e 523b68ba-e312-9909-a3ca-39cc86aaf206 [VpxLRO] -- BEGIN lro-846068 -- SessionManager -- vim.Sessio⋯6b1-c4d5-4d7708671c5e(523b68ba-e312-9909-a3ca-39cc86aaf206) 
+log_line        log_time         log_level  comp             opid              tid   user   file   item   line  prc  reason  req    sid         src        sub   vpxa_update match_index   lro_id         entity                       operation                              SessionId                           SessionSubId             log_part log_idle_msecs log_mark log_comment log_tags log_annotations log_filters                                                         log_body                                                         
+       0 2022-06-02 11:58:12.193 info      <NULL> 7e1280cf                    45715 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846063 SessionManager     vim.SessionManager.sessionIsActive        528e6e0c-246d-58b5-3234-278c6e0c5d0d 52c289ac-2563-48d5-8a8e-f178da022c0d   <NULL>              0        0      <NULL>   <NULL>          <NULL>      <NULL> [VpxLRO] -- BEGIN lro-846063 -- SessionManager -- vim.Sessio⋯8b5-3234-278c6e0c5d0d(52c289ac-2563-48d5-8a8e-f178da022c0d) 
+       2 2022-06-02 11:58:12.376 info      <NULL> e3979f6                     45709 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846064 SessionManager     vim.SessionManager.sessionIsActive        52626140-422b-6287-b4e4-344192c6a01d 523e0a4b-6e83-6bcd-9342-22502dd89866   <NULL>            182        0      <NULL>   <NULL>          <NULL>      <NULL> [VpxLRO] -- BEGIN lro-846064 -- SessionManager -- vim.Sessio⋯287-b4e4-344192c6a01d(523e0a4b-6e83-6bcd-9342-22502dd89866) 
+       4 2022-06-02 11:58:12.623 info      <NULL> l3wrhr4o-cbf-h5:70001034-60 47524 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846066 ChangeLogCollector vim.cdc.ChangeLogCollector.waitForChanges 526861fc-0c28-1930-ae5e-d8c2772bf8c2 52a7a308-9646-c054-f1e7-16131c1a7db6   <NULL>            246        0      <NULL>   <NULL>          <NULL>      <NULL> [VpxLRO] -- BEGIN lro-846066 -- ChangeLogCollector -- vim.c⋯1930-ae5e-d8c2772bf8c2(52a7a308-9646-c054-f1e7-16131c1a7db6) 
+       6 2022-06-02 11:58:12.736 info      <NULL> 499b440                     48432 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846067 SessionManager     vim.SessionManager.sessionIsActive        521fe9f6-d061-11a2-ac86-badb3c071373 524cba9b-2cc4-9b70-32e4-421452a404d7   <NULL>            113        0      <NULL>   <NULL>          <NULL>      <NULL> [VpxLRO] -- BEGIN lro-846067 -- SessionManager -- vim.Sessio⋯1a2-ac86-badb3c071373(524cba9b-2cc4-9b70-32e4-421452a404d7) 
+       8 2022-06-02 11:58:12.740 info      <NULL> 55a419df                    48035 <NULL> <NULL> <NULL> <NULL> vpxd <NULL> <NULL> <NULL> Originator@6876 vpxLro      <NULL>           0 lro-846068 SessionManager     vim.SessionManager.sessionIsActive        52585600-b0bc-76b1-c4d5-4d7708671c5e 523b68ba-e312-9909-a3ca-39cc86aaf206   <NULL>              4        0      <NULL>   <NULL>          <NULL>      <NULL> [VpxLRO] -- BEGIN lro-846068 -- SessionManager -- vim.Sessio⋯6b1-c4d5-4d7708671c5e(523b68ba-e312-9909-a3ca-39cc86aaf206) 

test/expected/test_sql_views_vtab.sh_62d15cb9d5a9259f198aa01ca8ed200d6da38d68.out

@@ -1,3 +1,3 @@
 view_name filter_id enabled type language pattern 
-log               1       1 in   regex    vmk     
-log               2       1 in   regex    vmk1    
+log               1       1 in   regex    vmk     
+log               2       1 in   regex    vmk1    

test/expected/test_sql_views_vtab.sh_81dc3eb51ec4dc3066a2365524001242c423a9cf.out

@@ -1,2 +1,2 @@
 view_name filter_id enabled type language pattern 
-log               0       1 out  sql      1       
+log               0       1 out  sql      1       

test/expected/test_sql_views_vtab.sh_a2c0f0e51b3f85ea2a05ecdcacaad962b4fe5d4f.out

@@ -1,2 +1,2 @@
 view_name filter_id enabled type language pattern 
-log               1       1 in   regex    vmk     
+log               1       1 in   regex    vmk     

test/test_sql.sh

@@ -30,118 +30,26 @@ run_cap_test ${lnav_test} -n \
 
 cp ${srcdir}/logfile_syslog.2 logfile_syslog_test.2
 touch -t 201511030923 logfile_syslog_test.2
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT *, log_msg_schema FROM all_logs" \
     -c ":write-csv-to -" \
     logfile_syslog_test.2
 
-check_output "all_logs does not work?" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_msg_format,log_msg_values,log_msg_schema
-0,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is up,"{""col_0"":""eth0""}",ce6143108d22799c9c7a994e21e7302e
-1,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is up,"{""col_0"":""eth1""}",ce6143108d22799c9c7a994e21e7302e
-2,<NULL>,2015-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,# is down,"{""col_0"":""eth0""}",83cd119b5b6f7e79abff4d28946b7a61
-EOF
-
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT fields FROM logfmt_log" \
     -c ":write-json-to -" \
     ${test_dir}/logfile_logfmt.0
 
-check_output "logfmt fields are not handled correctly?" <<EOF
-[
-    {
-        "fields": {
-            "namespace": "inc-1-enh-domain-c14-ns-2",
-            "pod": "hello-inc-1-enh-domain-c14-ns-2-3-d8f465685-k75gp",
-            "reason": "",
-            "status": "Pending"
-        }
-    },
-    {
-        "fields": {
-            "error": "pod inc-1-domain-c14-ns-6/fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b is not found: PodNotFound",
-            "namespace": "inc-1-domain-c14-ns-6",
-            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
-            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
-        }
-    },
-    {
-        "fields": {
-            "namespace": "inc-1-domain-c14-ns-6",
-            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
-            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
-        }
-    },
-    {
-        "fields": {
-            "namespace": "inc-1-domain-c14-ns-6",
-            "pod": "fe-inc-1-domain-c14-ns-6-5-656d9bb695-4584b",
-            "uid": "be2def59-3a08-42fd-8f84-6f64cfcefa93"
-        }
-    },
-    {
-        "fields": {
-            "namespace": "inc-1-enh-domain-c14-ns-2",
-            "pod": "hello-inc-1-enh-domain-c14-ns-2-7-5ddd6bcd69-6rqct",
-            "reason": "",
-            "status": "Pending"
-        }
-    }
-]
-EOF
-
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT sc_substatus FROM w3c_log" \
     -c ":write-json-to -" \
     ${test_dir}/logfile_w3c.3
 
-check_output "w3c quoted strings are not handled correctly?" <<EOF
-[
-    {
-        "sc_substatus": 0
-    },
-    {
-        "sc_substatus": 0
-    },
-    {
-        "sc_substatus": null
-    }
-]
-EOF
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT cs_headers FROM w3c_log" \
     -c ":write-json-to -" \
     ${test_dir}/logfile_w3c.3
 
-check_output "w3c headers are not captured?" <<EOF
-[
-    {
-        "cs_headers": {
-            "User-Agent": "Mozilla/5.0 (Linux; Android 4.4.4; SM-G900V Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.59 Mobile Safari/537.36",
-            "Referer": "http://example.com/Search/SearchResults.pg?informationRecipient.languageCode.c=en",
-            "Host": "xzy.example.com"
-        }
-    },
-    {
-        "cs_headers": {
-            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36",
-            "Referer": null,
-            "Host": "example.hello.com"
-        }
-    },
-    {
-        "cs_headers": {
-            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36",
-            "Referer": null,
-            "Host": "hello.example.com"
-        }
-    }
-]
-EOF
-
 run_cap_test ${lnav_test} -n \
     -c ";SELECT * FROM generate_series()" \
     ${test_dir}/logfile_access_log.0
@@ -159,34 +67,16 @@ run_cap_test ${lnav_test} -n \
     -c ";SELECT raise_error('oops!')" \
     ${test_dir}/logfile_access_log.0
 
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT basename(filepath) as name, content, length(content) FROM lnav_file" \
     -c ":write-csv-to -" \
     ${test_dir}/logfile_empty.0
 
-check_output "empty content not handled correctly?" <<EOF
-name,content,length(content)
-logfile_empty.0,,0
-EOF
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT distinct xp.node_text FROM lnav_file, xpath('//author', content) as xp" \
     -c ":write-csv-to -" \
     ${test_dir}/books.xml
 
-check_output "xpath on file content not working?" <<EOF
-node_text
-"Gambardella, Matthew"
-"Ralls, Kim"
-"Corets, Eva"
-"Randall, Cynthia"
-"Thurman, Paula"
-"Knorr, Stefan"
-"Kress, Peter"
-"O'Brien, Tim"
-"Galos, Mike"
-EOF
-
 gzip -c ${srcdir}/logfile_json.json > logfile_json.json.gz
 dd if=logfile_json.json.gz of=logfile_json-trunc.json.gz bs=64 count=2
 
@@ -323,49 +213,21 @@ s_runtime
 0.01
 EOF
 
-run_test env TZ=UTC ${lnav_test} -n \
+run_cap_test env TZ=UTC ${lnav_test} -n \
     -c ";SELECT bro_conn_log.bro_duration as duration, bro_conn_log.bro_uid, group_concat( distinct (bro_method || ' ' || bro_host)) as req from bro_http_log, bro_conn_log where bro_http_log.bro_uid = bro_conn_log.bro_uid group by bro_http_log.bro_uid order by duration desc limit 10" \
     -c ":write-csv-to -" \
     ${test_dir}/logfile_bro_http.log.0 ${test_dir}/logfile_bro_conn.log.0
 
-check_output "bro logs are not recognized?" <<EOF
-duration,bro_uid,req
-116.438679,CwFs1P2UcUdlSxD2La,GET www.reddit.com
-115.202498,CdZUPH2DKOE7zzCLE3,GET feeds.bbci.co.uk
-115.121914,CdrfXZ1NOFPEawF218,GET c.thumbs.redditmedia.com
-115.121837,CoX7zA3OJKGUOSCBY2,GET e.thumbs.redditmedia.com
-115.12181,CJxSUgkInyKSHiju1,GET e.thumbs.redditmedia.com
-115.121506,CT0JIh479jXIGt0Po1,GET f.thumbs.redditmedia.com
-115.121339,CJwUi9bdB9c1lLW44,GET f.thumbs.redditmedia.com
-115.119217,C6Q4Vm14ZJIlZhsXqk,GET a.thumbs.redditmedia.com
-72.274459,CbNCgO1MzloHRNeY4f,GET www.google.com
-71.658218,CnGze54kQWWpKqrrZ4,GET ajax.googleapis.com
-EOF
-
-run_test env TZ=UTC ${lnav_test} -n \
+run_cap_test env TZ=UTC ${lnav_test} -n \
     -c ";SELECT * FROM bro_http_log LIMIT 5" \
     -c ":write-csv-to -" \
     ${test_dir}/logfile_bro_http.log.0
 
-check_output "bro logs are not recognized?" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
-0,<NULL>,2011-11-03 00:19:26.452,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.452687,CwFs1P2UcUdlSxD2La,192.168.2.76,52026,132.235.215.119,80,1,GET,www.reddit.com,/,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,109978,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Ftw3fJ2JJF3ntMTL2,<NULL>,text/html
-1,<NULL>,2011-11-03 00:19:26.831,379,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831619,CJxSUgkInyKSHiju1,192.168.2.76,52030,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/E-pbDbmiBclPkDaX.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2300,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FFTf9Zdgk3YkfCKo3,<NULL>,image/jpeg
-2,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831563,CJwUi9bdB9c1lLW44,192.168.2.76,52029,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/BP5bQfy4o-C7cF6A.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2272,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,FfXtOj3o7aub4vbs2j,<NULL>,image/jpeg
-3,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831473,CoX7zA3OJKGUOSCBY2,192.168.2.76,52027,72.21.211.173,80,1,GET,e.thumbs.redditmedia.com,/SVUtep3Rhg5FTRn4.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,2562,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F21Ybs3PTqS6O4Q2Zh,<NULL>,image/jpeg
-4,<NULL>,2011-11-03 00:19:26.831,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279566.831643,CT0JIh479jXIGt0Po1,192.168.2.76,52031,72.21.211.173,80,1,GET,f.thumbs.redditmedia.com,/uuy31444rLSyKdHS.jpg,http://www.reddit.com/,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,1595,200,OK,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,Fdk0MZ1wQmKWAJ4WH4,<NULL>,image/jpeg
-EOF
-
-run_test env TZ=UTC ${lnav_test} -n \
+run_cap_test env TZ=UTC ${lnav_test} -n \
     -c ";SELECT * FROM bro_http_log WHERE log_level = 'error'" \
     -c ":write-csv-to -" \
     ${test_dir}/logfile_bro_http.log.0
 
-check_output "bro logs are not recognized?" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,bro_ts,bro_uid,bro_id_orig_h,bro_id_orig_p,bro_id_resp_h,bro_id_resp_p,bro_trans_depth,bro_method,bro_host,bro_uri,bro_referrer,bro_version,bro_user_agent,bro_request_body_len,bro_response_body_len,bro_status_code,bro_status_msg,bro_info_code,bro_info_msg,bro_tags,bro_username,bro_password,bro_proxied,bro_orig_fuids,bro_orig_filenames,bro_orig_mime_types,bro_resp_fuids,bro_resp_filenames,bro_resp_mime_types
-118,<NULL>,2011-11-03 00:19:49.337,18,error,0,<NULL>,<NULL>,<NULL>,<NULL>,1320279589.337053,CBHHuR1xFnm5C5CQBc,192.168.2.76,52074,74.125.225.76,80,1,GET,i4.ytimg.com,/vi/gDbg_GeuiSY/hqdefault.jpg,<NULL>,1.1,Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20100101 Firefox/7.0.1,0,893,404,Not Found,<NULL>,<NULL>,,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,<NULL>,F2GiAw3j1m22R2yIg2,<NULL>,image/jpeg
-EOF
-
 run_test ${lnav_test} -n \
     -c ';select log_time from access_log where log_line > 100000' \
     -c ':switch-to-view db' \
@@ -499,59 +361,29 @@ log_line,log_part
 EOF
 
 
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -I "${top_srcdir}/test" \
     -c ";select * from web_status" \
     -c ':write-csv-to -' \
     ${test_dir}/logfile_access_log.0
 
-check_output "access_log table is not working" <<EOF
-group_concat(cs_uri_stem),sc_status
-"/vmw/cgi/tramp,/vmw/vSphere/default/vmkernel.gz",200
-/vmw/vSphere/default/vmkboot.gz,404
-EOF
-
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";select * from access_log" \
     -c ':write-csv-to -' \
     ${test_dir}/logfile_access_log.0
 
-check_output "access_log table is not working" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
-0,<NULL>,2009-07-20 22:59:26.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/cgi/tramp,gPXE/0.9.7,-,HTTP/1.0,134,200,<NULL>
-1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
-2,<NULL>,2009-07-20 22:59:29.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkernel.gz,gPXE/0.9.7,-,HTTP/1.0,78929,200,<NULL>
-EOF
-
-
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";select * from access_log where log_level >= 'warning'" \
     -c ':write-csv-to -' \
     ${test_dir}/logfile_access_log.0
 
-check_output "loglevel collator is not working" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
-1,<NULL>,2009-07-20 22:59:29.000,3000,error,0,<NULL>,<NULL>,<NULL>,<NULL>,192.168.202.254,GET,-,<NULL>,/vmw/vSphere/default/vmkboot.gz,gPXE/0.9.7,-,HTTP/1.0,46210,404,<NULL>
-EOF
-
-
 # XXX The timestamp on the file is used to determine the year for syslog files.
 touch -t 200711030923 ${test_dir}/logfile_syslog.0
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";select * from syslog_log" \
     -c ':write-csv-to -' \
     ${test_dir}/logfile_syslog.0
 
-check_output "syslog_log table is not working" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,log_hostname,log_msgid,log_pid,log_pri,log_procname,log_struct,log_syslog_tag,syslog_version
-0,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7998,<NULL>,automount,<NULL>,automount[7998],<NULL>
-1,<NULL>,2007-11-03 09:23:38.000,0,info,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,16442,<NULL>,automount,<NULL>,automount[16442],<NULL>
-2,<NULL>,2007-11-03 09:23:38.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,7999,<NULL>,automount,<NULL>,automount[7999],<NULL>
-3,<NULL>,2007-11-03 09:47:02.000,1404000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,veridian,<NULL>,<NULL>,<NULL>,sudo,<NULL>,sudo,<NULL>
-EOF
-
-
 run_test ${lnav_test} -n \
     -c ";select * from syslog_log where log_time >= NULL" \
     -c ':write-csv-to -' \
@@ -829,60 +661,11 @@ run_cap_test ${lnav_test} -n \
     -c ":write-csv-to -" \
     ${test_dir}/logfile_partitions.0
 
-run_test ${lnav_test} -n \
+run_cap_test ${lnav_test} -n \
     -c ";SELECT * FROM openam_log" \
     -c ":write-json-to -" \
     ${test_dir}/logfile_openam.0
 
-check_output "write-json-to isn't working?" <<EOF
-[
-    {
-        "log_line": 0,
-        "log_part": null,
-        "log_time": "2014-06-15 01:04:52.000",
-        "log_idle_msecs": 0,
-        "log_level": "info",
-        "log_mark": 0,
-        "log_comment": null,
-        "log_tags": null,
-        "log_annotations": null,
-        "log_filters": null,
-        "contextid": "82e87195d704585501",
-        "data": "http://localhost:8086|/|<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"s2daac0735bf476f4560aab81104b623bedfb0cbc0\" InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" Version=\"2.0\" IssueInstant=\"2014-06-15T01:04:52Z\" Destination=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"><saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://openam.vagrant.dev/openam</saml:Issuer><samlp:Status xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">\\\\n<samlp:StatusCode  xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"\\\\nValue=\"urn:oasis:names:tc:SAML:2.0:status:Success\">\\\\n</samlp:StatusCode>\\\\n</samlp:Status><saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"s2a0bee0da937e236167e99b209802056033816ac2\" IssueInstant=\"2014-06-15T01:04:52Z\" Version=\"2.0\">\\\\n<saml:Issuer>http://openam.vagrant.dev/openam</saml:Issuer><ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\\\\n<ds:SignedInfo>\\\\n<ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\\\n<ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\\\\n<ds:Reference URI=\"#s2a0bee0da937e236167e99b209802056033816ac2\">\\\\n<ds:Transforms>\\\\n<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"/>\\\\n<ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\\\\n</ds:Transforms>\\\\n<ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/>\\\\n<ds:DigestValue>4uSmVzjovUdQd3px/RcnoxQBsqE=</ds:DigestValue>\\\\n</ds:Reference>\\\\n</ds:SignedInfo>\\\\n<ds:SignatureValue>\\\\nhm/grge36uA6j1OWif2bTcvVTwESjmuJa27NxepW0AiV5YlcsHDl7RAIk6k/CjsSero3bxGbm56m\\\\nYncOEi9F1Tu7dS0bfx+vhm/kKTPgwZctf4GWn4qQwP+KeoZywbNj9ShsYJ+zPKzXwN4xBSuPjMxP\\\\nNf5szzjEWpOndQO/uDs=\\\\n</ds:SignatureValue>\\\\n<ds:KeyInfo>\\\\n<ds:X509Data>\\\\n<ds:X509Certificate>\\\\nMIICQDCCAakCBEeNB0swDQYJKoZIhvcNAQEEBQAwZzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh\\\\nbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMQwwCgYDVQQKEwNTdW4xEDAOBgNVBAsTB09w\\\\nZW5TU08xDTALBgNVBAMTBHRlc3QwHhcNMDgwMTE1MTkxOTM5WhcNMTgwMTEyMTkxOTM5WjBnMQsw\\\\nCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLU2FudGEgQ2xhcmExDDAK\\\\nBgNVBAoTA1N1bjEQMA4GA1UECxMHT3BlblNTTzENMAsGA1UEAxMEdGVzdDCBnzANBgkqhkiG9w0B\\\\nAQEFAAOBjQAwgYkCgYEArSQc/U75GB2AtKhbGS5piiLkmJzqEsp64rDxbMJ+xDrye0EN/q1U5Of+\\\\nRkDsaN/igkAvV1cuXEgTL6RlafFPcUX7QxDhZBhsYF9pbwtMzi4A4su9hnxIhURebGEmxKW9qJNY\\\\nJs0Vo5+IgjxuEWnjnnVgHTs1+mq5QYTA7E6ZyL8CAwEAATANBgkqhkiG9w0BAQQFAAOBgQB3Pw/U\\\\nQzPKTPTYi9upbFXlrAKMwtFf2OW4yvGWWvlcwcNSZJmTJ8ARvVYOMEVNbsT4OFcfu2/PeYoAdiDA\\\\ncGy/F2Zuj8XJJpuQRSE6PtQqBuDEHjjmOQJ0rV/r8mO1ZCtHRhpZ5zYRjhRC9eCbjx9VrFax0JDC\\\\n/FfwWigmrW0Y0Q==\\\\n</ds:X509Certificate>\\\\n</ds:X509Data>\\\\n</ds:KeyInfo>\\\\n</ds:Signature><saml:Subject>\\\\n<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" NameQualifier=\"http://openam.vagrant.dev/openam\">user@example.com</saml:NameID><saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\">\\\\n<saml:SubjectConfirmationData InResponseTo=\"84cbf2be33f6410bbe55877545a93f02\" NotOnOrAfter=\"2014-06-15T01:14:52Z\" Recipient=\"http://localhost:8086/api/1/rest/admin/org/530e42ccd6f45fd16d0d0717/saml/consume\"/></saml:SubjectConfirmation>\\\\n</saml:Subject><saml:Conditions NotBefore=\"2014-06-15T00:54:52Z\" NotOnOrAfter=\"2014-06-15T01:14:52Z\">\\\\n<saml:AudienceRestriction>\\\\n<saml:Audience>http://localhost:8086</saml:Audience>\\\\n</saml:AudienceRestriction>\\\\n</saml:Conditions>\\\\n<saml:AuthnStatement AuthnInstant=\"2014-06-15T01:00:25Z\" SessionIndex=\"s2f9b4d4b453d12b40ef3905cc959cdb40579c2301\"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>",
-        "domain": "dc=openam",
-        "hostname": "192.168.33.1\t",
-        "ipaddr": "Not Available",
-        "loggedby": "cn=dsameuser,ou=DSAME Users,dc=openam",
-        "loginid": "id=openamuser,ou=user,dc=openam",
-        "messageid": "SAML2-37",
-        "modulename": "SAML2.access",
-        "nameid": "user@example.com"
-    },
-    {
-        "log_line": 1,
-        "log_part": null,
-        "log_time": "2014-06-15 01:04:52.000",
-        "log_idle_msecs": 0,
-        "log_level": "trace",
-        "log_mark": 0,
-        "log_comment": null,
-        "log_tags": null,
-        "log_annotations": null,
-        "log_filters": null,
-        "contextid": "ec5708a7f199678a01",
-        "data": "vagrant|/",
-        "domain": "dc=openam",
-        "hostname": "127.0.1.1\t",
-        "ipaddr": "Not Available",
-        "loggedby": "cn=dsameuser,ou=DSAME Users,dc=openam",
-        "loginid": "cn=dsameuser,ou=DSAME Users,dc=openam",
-        "messageid": "COT-22",
-        "modulename": "COT.access",
-        "nameid": "Not Available"
-    }
-]
-EOF
-
 touch -t 200711030000 ${srcdir}/logfile_for_join.0
 
 run_cap_test ${lnav_test} -d "/tmp/lnav.err" -n \
@@ -968,18 +751,11 @@ unset LNAVSECURE
 
 
 touch -t 201503240923 ${test_dir}/logfile_syslog_with_access_log.0
-run_test ${lnav_test} -n -d /tmp/lnav.err \
+run_cap_test ${lnav_test} -n -d /tmp/lnav.err \
     -c ";select * from access_log" \
     -c ':write-csv-to -' \
     ${test_dir}/logfile_syslog_with_access_log.0
 
-check_output "access_log not found within syslog file" <<EOF
-log_line,log_part,log_time,log_idle_msecs,log_level,log_mark,log_comment,log_tags,log_annotations,log_filters,c_ip,cs_method,cs_referer,cs_uri_query,cs_uri_stem,cs_user_agent,cs_username,cs_version,sc_bytes,sc_status,cs_host
-1,<NULL>,2015-03-24 14:02:50.000,6927348000,info,0,<NULL>,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/includes/js/combined-javascript.js,<NULL>,-,HTTP/1.1,65508,200,<NULL>
-2,<NULL>,2015-03-24 14:02:50.000,0,error,0,<NULL>,<NULL>,<NULL>,<NULL>,127.0.0.1,GET,<NULL>,<NULL>,/bad.foo,<NULL>,-,HTTP/1.1,65508,404,<NULL>
-EOF
-
-
 run_test ${lnav_test} -n \
     -c ";select log_text from generic_log" \
     -c ":write-json-to -" \