The console
Lucene, with syntax colouring and completion over the stream’s own field names; afterfield: it offers the values that field holds in the streams and window you are searching, most frequent first, with how often each occurs. ⌘ ⏎ runs it; the toolbar’s range picker chooses the window, or write one into the query. | group by field at the end turns the result into counts per value; | p95(took_ms), avg(took_ms) after it adds those per value too (avg, min, max, sum, unique and any percentile from p50 to p99), and the ⋮ at the end of a table’s header exports it as CSV or JSON.
The grid
Virtualised, sortable, resizable columns, a row-number gutter, and severity colouring on level and status cells. Select a row and the value inspector shows it as syntax-coloured JSON, with strings that contain JSON expanded into real structure. Right-click a cell to narrow the query to it, exclude it, count by it, or look at the minutes around that one line.Saved queries
⌘ S keeps the query by name in the Queries tool window on the right. Saved queries can be watched, and its History tab keeps every query you ran.Sharing a view
Copy a link to this view turns a console into aflux:// link: from the link button on the console’s toolbar, or by right-clicking a saved query or one in the History. Whoever opens it gets the same stream, query and range in their own Flux, through their own connection to the same Graylog. The link names the Graylog by its address and never carries a token; a view that searches several streams has no link, since a link names one.
Search Everywhere
⇧ ⇧ opens a search over every stream, endpoint, project, past query and action. ⇧ ⌘ O opens it on endpoints.Workspaces
Open a folder as a workspace and Flux keeps that folder’s stream grouping, tabs and layout in a.flux directory inside it, the way an IDE keeps .idea.