any way to use AND + OR in Log Live View?

[tessus]

I was trying to narrow down the output in Firewall -> Log Files -> Live View, but noticed (to mu surprise) that I can either use AND, or OR operators, but not a combination of both and parenthesis.

Is there any way this will be added in the future or is this not useful to others? e.g. for me it is impossible to retrieve the info I want.

But I understand that it might be a GUI issue to set () and OR and AND and thus cannot be easily implemented. But I think I might have an idea: next to the apply button there could be other buttons for (, ), OR, AND
Apply just adds the current filter to the active filter, if you want to add additional ones, you have to use one of the other buttons first (and then apply to add the expression).
That seems doable.

I would love to implement this myself, but I suck at UIs and frontend stuff.
   

[pfry]

You could submit a feature request. Offhand it seems like a niche feature. Have you investigated tailoring your rules for logging?

[letsief]

I was trying to narrow down the output in Firewall -> Log Files -> Live View, but noticed (to mu surprise) that I can either use AND, or OR operators, but not a combination of both and parenthesis.

Is there any way this will be added in the future or is this not useful to others? e.g. for me it is impossible to retrieve the info I want.

But I understand that it might be a GUI issue to set () and OR and AND and thus cannot be easily implemented. But I think I might have an idea: next to the apply button there could be other buttons for (, ), OR, AND
Apply just adds the current filter to the active filter, if you want to add additional ones, you have to use one of the other buttons first (and then apply to add the expression).
That seems doable.

I would love to implement this myself, but I suck at UIs and frontend stuff.

+1.  This seems like a pretty basic feature for filtering. I just set up opnsense, but I was very surprised when I saw this was missing.

[pfry]

If you go for the feature, I'd recommend a "saved"/"favorites"/whatever or more complex notation in the "quick search" so you don't have to poke in your search one button at a time, every time.

[tessus]

Thanks for the replies. Before I submit a feature request, I'd like to hear from the devs whether this is something they'd consider. I do not like to create unneccessary cognitive load on people who are already busy with maintaining a product that also has a roadmap for future releases.

It's also a matter of priority. afaik this type of filtering is only used in the live view page, thus its reusability is basically non-existent.
I also do not know how complex this might be. (As I mentioned, I suck as a dev, when it comes to UI and frontend stuff.)
If I were a dev in this project, such a FR would be a rather low priority with a nice-to-have label, unless I could implement it in less than 30 minutes.