Reading Huge Logs by Color — a Highlighter That Doesn't Stutter at 100 Million Lines

In v1.1 of UwView, my large-file text viewer (free, source on GitHub), I implemented a color highlighter. When I honestly compared features with the industry-standard klogg, "multi-keyword color highlighting" was a clear item on my loss list — something klogg had that UwView didn't. This release fills in that line on the scoreboard.

And it didn't stop at catching up. UwView ships with use-case presets built in from the start, and also supports exporting/importing rule sets. This article walks through what you can now do — and the design choices that keep coloring smooth even on a 100-million-line file.

For testing I used an XML file with 100,000,000 lines converted from OpenStreetMap Japan data.

Search's "Yellow" and Highlighting's "Red/Blue" Work Together at the Same Time

The basic layout: body text on the left, search-results (filter) popup on the right. A search for "Wakayama" hit 1,129 matches, listed with ±1 line of surrounding context.

The point to notice is that the yellow of the search match and the red applied by the color highlighter both appear on the same screen at the same time. UwView's highlighter is designed so that search matches are always drawn with top priority — no matter how many colors you stack, the yellow of the term you're currently searching for always stays on top. This avoids the common failure mode of this kind of feature, where too much coloring buries the search results.

One more understated bit of engineering: coloring is evaluated only for the lines currently visible on screen, each time. That's why, even with a 100-million-line file, the coloring never falls behind while scrolling.

Color Rules Are Built from Patterns and Background Colors

Coloring is managed in a dedicated "Color Highlighter" dialog. Each line is one rule, assigning a text color and a background color to a pattern (a literal string or a regular expression).

Regular expression support — you can also color just the captured portion of a match.
Case sensitivity (Aa) and whether to highlight the whole line can be set per rule.
Rules are prioritized top to bottom. When rules overlap, the lower row wins; reorder with ▲▼.
Too many colors makes things harder to distinguish — aim for around 8 to 12 colors per screen. Colors come from a color-vision-friendly 32-color palette and cycle automatically as you add rules.

You can save a rule set under a name, so you can switch between them per project or per system you're monitoring.

Bundled Presets for "syslog" and "Web Access Logs"

This is the part that goes beyond simply catching up with klogg. UwView v1.1 ships with commonly used coloring rules built in. Pick a preset, click "Load," and the colors apply on the spot.

The syslog / Linux preset colors emerg / alert / crit / err red, warning orange, notice / info green, and also assigns colors to the PID at the start of a line ([number]) and to IP addresses.

The Web access (HTTP) preset lets you read HTTP status codes by color: 5xx red, 4xx orange, 3xx blue, 2xx green — clusters of errors jump out at you just from skimming an access log.

These presets can be used as-is or rewritten to your own taste. A finished rule set exports as a .uwvhl file and can be shared with another machine or a teammate via import — you can hand out "site-specific coloring configurations" to everyone who needs them.

Search History and Predefined Filters Also Improved

Alongside coloring, v1.1 raises the bar around search: up to 50 history entries with autocomplete, and starred (★) searches saved for instant reuse from a dropdown. This too fills an area where klogg previously had the edge.

The items still remaining on my loss list stay published openly in the repository. The policy of laying everything out honestly and filling gaps one by one is unchanged.

One thing I'm particular about, though: even when adding a feature I was behind on, I don't copy klogg's implementation — I redesign it into a form that feels good to use every day before shipping it. The color highlighter is exactly that: not just "you can apply colors," but "the search yellow stays on top at all times," "presets bundled for common use cases," and "only visible lines are evaluated, so speed never drops at 100 million lines" — the things you actually want once you're working with genuinely huge logs.

Summary

UwView v1.1 implements a color highlighter, filling in one line on the list of items where klogg had the edge.
Supports regular expressions, text/background colors, rule priority, and named saves. Search-match yellow always stays on top, and coloring stays fast even at 100 million lines.
Ships with presets for syslog, web access logs, and more; rule sets are shareable as .uwvhl files via export/import.
Search history and predefined filters also improved. Remaining gaps stay listed openly, to be filled in a form that's genuinely comfortable to use — not by copying klogg.

The commercial UwView Pro is also on sale (all OS: Windows/macOS/Linux; one-time $129 / $9 per month) — persistent index for instant reopens with line numbers, search up to ~9x faster, and ~1/9-size archival storage that opens directly. The color highlighter and presets covered here work the same way in Pro.

Sources

klogg official documentation https://github.com/variar/klogg/blob/master/DOCUMENTATION.md
amru195704/UwView (GitHub) https://github.com/amru195704/UwView

From the developer: a list of my apps, Kindle books and open-source projects is on GitHub: amru195704. Screenshots of everything described here are in the original article.