Settings

Edit → Settings… (Ctrl+,), or Logsift → Settings on macOS (⌘,). Changes apply at once. Eight tabs: General, Log Formats, Source Code, Metrics, Agents, Assistant, Crash Dumps, Network.

General

Updating

Click the status bar’s button (or Help → Check for Updates…), then Update and Restart:

1. Logsift downloads the file for your computer, from GitHub only, with GitHub’s certificate checked.
2. It checks the file against the release’s SHA-256 checksums (SHA256SUMS.txt). A file that doesn’t match isn’t used.
3. It makes the new version ready beside the app; the running one isn’t touched.
4. It restarts with the new version, and the files you had open open again. When I Quit puts the new version in place the next time you quit, instead.

How the new version goes in depends on how Logsift was installed:

Self-update starts with 1.4.1: versions before it have no checksums to check against, so install 1.4.1 (or a snapshot build) by hand once. A Logsift you built yourself, or a beta, doesn’t update itself. What the update did is written to update.log in Logsift’s folder (~/.logsift/updates).

Log formats

When Logsift doesn’t know a log’s layout, the Columns view says so and offers Define Its Format…. Formats are also under View → Log Format → New Format from This Log…. There are three ways to make one:

1. Drop a log file here (or Open a Log File…). Logsift guesses the layout from its lines (time, level, [thread], logger, separators) and how its times are written.
2. Or paste how your program logs, then Create Format: a log4j, Log4j 2 or logback pattern such as %d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n, a whole logback.xml, log4j2.xml or log4j.properties, Spring Boot’s layout, a java.util.logging SimpleFormatter.format, or a Python logging format, logging.conf or basicConfig(…). When a config has several layouts, each becomes a format.
3. Write a Pattern Yourself…: {time} {level} [{thread}] {logger} - {message}. Columns go in braces; everything else is matched as written. {*} skips a part. A regex with named groups like (?<level>…) works too.

Each format has a Name, a Line pattern, a Time format (empty for any common timestamp), and Always use for (file names like app*.log; *.trace). A preview shows sample lines split into columns.

A format is used when most of a log’s lines fit it, or always for the file names you give. The log’s bar shows the format each log is read with (Format: …▾, on the right); click it to choose another for that file, or Plain text. Levels in your format’s level column drive the colours, the error marks and the E W I D T buttons.

Formats are saved in ~/.logsift/formats.properties; copy it to use them on another computer.

Source code

For opening a stack frame in your editor (see Exceptions):

• Source folders: your projects’ source code. Add Folder…, Remove.
• Open with: Automatic (IntelliJ IDEA or PyCharm when installed, else Visual Studio Code), IntelliJ IDEA, PyCharm, Visual Studio Code, The system’s app for the file (without the line), or My own command.
• Command (for My own command): for example myeditor --goto {file}:{line}. {file} and {line} are filled in; put quotes around a path with spaces.

Other settings in the menus

• Help → Check for Updates Automatically: the same as the update setting above.
• View → Encoding: reopens one log in another encoding.
• View → Log Format: the format for one log.
• Each log’s view buttons (Wrap, Columns, Tree, Timeline, Follow, Reload Automatically) are remembered as the default for the next log you open.

Where Logsift keeps its files

In ~/.logsift (your home folder):

Other preferences (window size, recent files, last folders, servers and users, never passwords) are kept in Java’s preferences store for your user.

Logsift never sends your logs anywhere. Its only network connections are the update check (if on) and the servers you choose: SSH servers, JMX ports, and web addresses you open. With a Windows dump, it can also download the names of Windows’ own files from Microsoft’s symbol server, only when you click Download Windows’ Names or turn that on under Crash Dumps. When you set up a coding agent, what Logsift answers it goes to the agent’s AI provider.

Network

The proxy Logsift uses for update checks and for logs opened from web addresses (coding agents’ too). SSH servers and JMX ports are reached directly.

The line beside Test Connection says how GitHub is reached now (directly, or through the proxy proxy.example.com:8080). Test Connection reaches GitHub as an update check does and says what happened: Reached github.com through the proxy …, or what’s wrong (a proxy that can’t be found, doesn’t answer, wants a sign-in, refuses GitHub, or shows secure connections with a certificate this computer doesn’t trust).

When the proxy asks for a name and password, Logsift asks you (Proxy Sign-In): the name is remembered, the password only until Logsift quits. A proxy that signs you in as Windows does (NTLM, Kerberos) needs nothing.

Crash Dumps

Where Windows dumps find function names and source lines:

• PDB folders: folders with your program’s .pdb files (and its .exe and .dll files, for minidumps). Add Folder…, Remove. Logsift also looks next to the dump, where the build put the PDB, and in the symbol caches named by _NT_SYMBOL_PATH.
• Download the names of Windows’ own files from Microsoft’s symbol server: off unless you turn it on. Only files under \Windows are asked for, by name and build id, never your program’s. Downloads are kept in ~/.logsift/symbols.

Coding agents use the same settings.

Metrics

Which numbers in messages the Metrics tab charts: numbers after known keys, every key except ids, codes and names, or only these keys; keys that never count; and how many measurements to show at most. Try a line shows which numbers of a line of your log count. Saved in ~/.logsift/metrics.properties.

Agents

How to let a coding agent such as GitHub Copilot ask Logsift about your logs, what is masked in its answers, which folders it may read, and what it may do to a running JVM (thread dumps, heap histograms, heap dumps). See Coding agents and Running JVMs.

Assistant

Who answers (GitHub Copilot or Claude Code, each your own program and sign-in), where the assistant opens (in a tab of its own, at the side of the window, or in a window of its own), whether it opens when Logsift starts, its text size (apart from the logs’ font; ⌘+ and ⌘- in the assistant change it too), and what it’s told before the first question: Logsift’s instructions, where your logs are, the step-by-step plans, the date and time, and your own instructions. Each part shows about how many tokens it costs with each question, and its words. See What it’s told. Audit sets whether the assistant’s audit keeps what went with each question and the instructions, and when it flags a question: a tool’s answer bigger than a size, more tokens, more time or more tool calls than set.