Repository navigation
Displays
A Display reformats matching events in every event view. It is a key regex
that recognises a line, plus a display_script that says how to reformat it.
This page describes the current design. Before 2026 a display script was Ruby: you defined a
parse_event(event_text)method andEvent#parsedeval'd it inside the web process. That was arbitrary code execution from the web UI, and it is gone. If you have old display scripts lying around, see What Changed Since 2016 — theregexdirective is usually the way to port them.
-
Display.helper_for_event(raw_line)returns the first Display whosekeyregex matches the line. Displays are tried in default order, so ordering matters when patterns overlap. -
Event#parsedruns that Display'sdisplay_scriptthroughDisplayRule, which parses the spec and renders the line. No Ruby from the database is ever evaluated. - Events that match no Display render normally.
One directive per line. # starts a comment.
| directive | meaning |
|---|---|
fields 1,2,5 |
emit these 1-based positional fields, in this order (position = whitespace-split index of the raw line) |
regex PATTERN |
emit PATTERN's capture groups instead of positions; with no groups, the whole match |
label 3=proto: |
prefix the 3rd emitted token with proto:
|
join , |
join emitted tokens with this separator (default: a single space) |
join's separator may not be a plain space — that is already the default.
label indexes the emitted token list, not the raw field list, so it composes
with fields and regex.
Postfix queue-id lines. key: postfix.*status=
regex (\w+): to=<([^>]+)>, relay=([^ ]+),.*status=(.*)
join ,
label 2=to:
label 3=relay:
label 4=status:
Matching lines render as their queue id, recipient, relay and status — each token still clickable as a search link in the event views. As with the old design, one Display can carry several patterns so a chatty daemon renders differently per message type.
- A malformed spec is rejected on save:
Display#display_script_is_validcallsDisplayRule.validate, and the form shows the offending line number. - At render time a spec that fails to parse, or that selects no fields, returns the raw line unchanged rather than raising. A bad rule degrades to "no reformatting" instead of breaking the dashboard.
- A
keyregex that is malformed or under-specified raises duringRegexp.new/match; that is swallowed, a warning is logged (Had to rescue: <key>), and evaluation continues with the next Display.
Displays are behind the Detective right. See Access Control.