Log LionWhat's new in 3.1
Log Lion 3.1 adds Docker containers, ETW traces, firewall logs, SQL databases and more ways to extend it. It's a free update for everyone who owns Log Lion 3.
- NewDocker, the first Enterprise extension, included with Log Lion 3.1.3. Open Source > Docker shows the containers of a compose project, or the ones you pick, from this computer's engine or a remote one, merged by time and followed live, each in its own color. JSON and logfmt lines open as fields, and Save As writes a .docker connection file to open the same view again or decode each service's lines your own way. See it.
- NewWindows Event Trace Logs (.etl). ETW captures from logman, xperf, wpr and Performance Monitor are decoded into time, provider, event ID, level, task, process, thread, processor, keywords and message columns. Events from providers not registered on your machine still show their header fields. The first open caches an index beside the file so it reopens fast.
- NewWindows Defender Firewall logs. Log Lion checks the Domain, Private and Public profiles and lists a source for each one with logging enabled, so there's no path to hunt down.
- NewSQL database logs. Read logs stored in a table in SQL Server, PostgreSQL, MySQL, Oracle, SQLite or any database with an ODBC driver, using a .lldb connection profile.
- NewMongoDB BSON files, as written by mongodump and change stream captures. Nested documents become dotted columns, real types drive the time column and severity icons, and a damaged file resumes at the next good document. BSON export too.
- Newlogfmt logs (.logfmt), and logfmt as a field parser in the Import Text Log wizard.
- NewLua scripts that process every entry in a log.
- NewExtensions (.llx). Third parties can add log formats and live data sources through a documented C interface. Log Lion asks before loading a new extension and remembers the answer against its SHA-256. Tools > Extensions shows what's installed; hold Shift at startup to skip them all.
- NewA Getting Started dialog, and a round of UI modernization.
- NewMicrosoft Store edition: Log Lion appears in Explorer's Open with list for log file types (.log, .txt, .csv, .json, .jsonl, .evtx, .etl, .har and others), and
loglion <file>opens a log from a command prompt. - AddedThe Extension SDK: a documented C header, two sample extensions, and llxprobe, which checks an extension against the interface before it's installed.
- AddedContent-based detection for plain text, CSV, TSV, JSON, JSON Lines and regular expression logs, so more files open as the right type automatically.
- AddedTools > Open Data Folder, which opens the folder holding plugins, text log profiles, filters and the license file.
- AddedDebug Output options for time zone offset and namespace. Use the Global namespace to capture from Windows services.
- AddedA context menu on the Source Info pane with Select All, Copy and Refresh.
- ChangedFaster timeline loading and better timeline highlighting.
- ChangedA new color scheme for severity levels.
- ChangedA clearer About box.
- ChangedA filter applied from Filter > Settings is now translated to a filter expression and shown in the Filter pane as the quick (ad hoc) filter, switching the pane to it if it was on a saved filter. You can read and extend what the dialog wrote, and F4 toggles it like any other quick filter.
- FixedTimestamps with a UTC offset, such as
2026-01-15T10:30:00-08:00, weren't recognized. They are now, and are adjusted to UTC. - FixedOpening a general text file with a .log extension could take a very long time while auto detection tried every profile.
- FixedUnmatched Pairs and Profiler paired an end event with the oldest open begin, which gave wrong durations for nested scopes. They now pair with the newest, and unmatched end events are no longer dropped.
- FixedHTTP Archive (.har) files weren't auto-detected without asking.
- FixedShort TSV rows could borrow fields from the next row.
- FixedRight and center aligned columns had no padding.
- FixedCrashes when opening a file with a very short name, and when formatting some IPv6 addresses.
- FixedEditing a filter's expression while the filter was toggled off, then pressing F4, showed the results of the old expression. A new quick filter could appear to find nothing, or the wrong entries. F4 now applies the expression as it is, and only reuses earlier results when it is unchanged.
- FixedComparing a column with a number in a filter, such as
$Duration > 100, compared them as text, so 26 was greater than 100. Columns that hold numbers now compare as numbers. - FixedThe column list that opens when you type
$in the filter editor was too small for its text, and its icons were drawn on black squares. It now sizes itself to its text and the screen's DPI, and the icons keep their transparency. - FixedIn the filter editor, typing a space inside a column name such as
Client IP Addresswhile the suggestion list was open duplicated part of the name. - FixedEvery entry in JSON Lines, CSV and other logs whose first column is the time showed the same time, and the timeline collapsed into a single bar.
- FixedThe timeline was labeled in UTC while the time column showed local time. The timeline axis, tooltips and double-click now use the same time as the column. The timeline tooltip also no longer stays on screen after the mouse leaves.
- FixedA hidden column shown again from the header menu or the Fields pane could come back as the first column, or out of order. It now returns to where it was.
- FixedColor > None was forgotten when the log was closed, and the menu never showed it as checked. The color column also showed its outline while coloring was off.
- FixedWith syntax highlighting on, text found by Edit > Find showed as
~!login!~when it followed punctuation, as in/account/login. - FixedWith syntax highlighting on, a
name=valuepair in the log list showed only its name when the value wasn't a number:order=A-10524showed asorder. - FixedSource Info for ETL and HAR logs ran the Created and Modified dates together with the property shown before them.