File data

Access file data using file search terms, directory scanning and Automatic extraction of compressed files (gz, tgz, zip…). The data is read via Secure Shell (SSH) from remote servers or from your local hard drive which allows for:

• Password or SSH key authorization

• Handling of different shells and installed Unix programs

• Server load handling with max connections, max parallel processes and Unix execution priority

• Identity change with sudo/su

• Jump servers

• Import of Putty sessions

Container data

You can access files from your local Docker and your remote or local Kubernetes. Container data is read via Docker and Kubernetes commands. Select container data using:

• Container and image names

• Kubernetes namespaces and pod names

• Kubernetes labels

Search and monitor

Searching phrases, time ranges and regex is most useful for file-based logs. It is optimized for speed, so that even large file bases can be efficiently processed. Most Linux and Windows file compression formats are supported.

Monitoring is the primary use case for container logs. When used for log files, it uses intelligent discovery of new files, covering the major log rotation schemas.

Unified view and context diving

Data from different container and file sources is combined into a unified result view that is timestamp-sorted by default. This allows for diving into the context of log entries by creating new searches or adapting the current search criteria.

Profiles and bookmarks

The configuration of hosts and containers as data sources can be made quickly ad-hoc or comprehensively elaborated. Saved configuration profiles allow you to reuse your specific setup and share it with other Retrospective users. All saved configuration is encrypted.

A search or monitor window can be saved as a bookmark. The bookmark includes the sources configuration and the search criteria that you may have built on top of it.

Parallel and multi-window desktop app

Retrospective is a multi-window desktop application for Windows, Mac and Linux. Search/Monitor windows are managed with simple tabs and can be “exploded” into individual windows that are intelligently distributed amongst your available screens.

A windows view setup can be stored and reused later.

Manual and automatic detection

When configuring log data sources, encoding, log entry separation and timestamp formatting is automatically detected when possible and can be manually fine-tuned.

Retrospective recognizes data structures by inspecting the data for recurring name-value pairs with common separation characters. The detected name-value pairs are stored with regex statements that can be adapted or custom regex statements can be created.

Column splitting

Beside name-value pairs, any custom regex statement can be created to split a reccurring chunk of log data into a dedicated column. For pre-structured log data, separation characters can be defined to split log data in multiple columns.