Falcon LogScale Documentation

Performance has improved for most usages of regex (we have moved to use RE2/J rather than Java's java.util.regex.)

Improve syntax highlighting in search field

When no field is named, i.e. as in /err/i, then @rawstring is being searched.

A bug has been fixed where searching for unicode characters could cause false positives.

When such a regex-match expression appears at top-level e.g. | between two bars |, then named capturing groups also cause new fields to be added to the output event as for the regex() function.

New syntax field = /regex/idmg syntax for matching. Optional flags i=ignore case, m=multiline (change semantics of $ and ^ to match each line, nut just start/end), d=dotall (. includes \n), and g=same as repeat=true for the regex() function. I.e. to case-insensitively find all log lines containing err (or ERR, or Err) you can now search /err/i