[docs] start a cookbook

docs/source/cookbook.rst

@@ -0,0 +1,20 @@
+
+.. _Cookbook:
+
+Cookbook
+========
+
+This chapter contains recipes for common tasks that can be done in **lnav**.
+These recipes can be used as a starting point for your own needs after some
+adaptation.
+
+
+Log Analysis
+------------
+
+To count the number of times a client IP shows up in the loaded web access
+logs:
+
+.. code-block:: custsqlite
+
+  ;SELECT c_ip, count(*) as hits FROM access_log GROUP BY c_ip ORDER BY hits DESC

docs/source/index.rst

@@ -16,6 +16,7 @@ Contents:
 
    intro
    usage
+   cookbook
    howitworks
    cli
    ui

docs/source/usage.rst

@@ -48,12 +48,13 @@ by pressing |ks| t |ke|.
 Archive Support
 ^^^^^^^^^^^^^^^
 
-If **lnav** is compiled with "libarchive", any files to be opened will be
+If **lnav** is compiled with `libarchive <https://www.libarchive.org>`_,
-examined to see if they are a supported archive type.  If so, the contents
+any files to be opened will be examined to see if they are a supported archive
-of the archive will be extracted to the :code:`$TMPDIR/lnav-${UID}-archives/`
+type.  If so, the contents of the archive will be extracted to the
-directory.  Once extracted, the files within will be loaded into lnav.  To
+:code:`$TMPDIR/lnav-${UID}-archives/` directory.  Once extracted, the files
-speed up opening large amounts of files, any file that meets the following
+within will be loaded into lnav.  To speed up opening large amounts of files,
-conditions will be automatically hidden and not indexed:
+any file that meets the following conditions will be automatically hidden and
+not indexed:
 
 * Binary files
 * Plain text files that are larger than 128KB

src/internals/cmd-ref.rst

@@ -540,6 +540,12 @@
 
       :filter-expr :log_procname = 'syslogd'
 
+    To set a filter expression that matches log messages where 'id' is followed by a number and contains the string 'foo':
+
+    .. code-block::  lnav
+
+      :filter-expr :log_body REGEXP 'id\d+' AND :log_body REGEXP 'foo'
+
   **See Also:**
 
     :ref:`clear_filter_expr`, :ref:`filter_in`, :ref:`filter_out`, :ref:`hide_lines_after`, :ref:`hide_lines_before`, :ref:`hide_unmarked_lines`, :ref:`toggle_filtering`

src/lnav_commands.cc

@@ -4734,6 +4734,11 @@ readline_context::command_t STD_COMMANDS[] = {
             .with_example({
                 "To set a filter expression that matched syslog messages from 'syslogd'",
                 ":log_procname = 'syslogd'"
+            })
+            .with_example({
+                "To set a filter expression that matches log messages where "
+                "'id' is followed by a number and contains the string 'foo'",
+                ":log_body REGEXP 'id\\d+' AND :log_body REGEXP 'foo'"
             }),
 
         com_filter_expr_prompt,