Column filters

After a search finishes (or while results are available in a session), Column filters let you narrow the result table using the named capturing groups from your regex pattern.

These filters run on the already-downloaded session data (fast local filtering). They do not re-run the remote SSH search.

How columns appear

The active directory/preset uses an extraction regex with capturing groups.
Each named group becomes a column (e.g. timestamp, level, logger, thread, message).
Rows are sorted chronologically by the timestamp group (oldest → newest). Lines with unparseable timestamps sort last.

Filterable vs timestamp

Column	Role
timestamp	Primary sort key. Not offered as a normal Combobox value filter in the column filter bar.
Other named groups	Each gets a filter control. Open it to pick suggested values or type a custom value.

Using a column filter

Open the filter for a column (e.g. level).
Optionally type in Search values to narrow suggestions (distinct values from the current session).
Select one or more suggested values and/or enter a Custom value.
Multiple selected values in the same column mean OR.
Click Apply filters.
Clear a column with Clear {column} filter when needed.

You can also toggle column visibility (Show column …) without clearing filters.

Relation to Complex search mode

Complex mode (on the search form) builds the remote pattern from group values before/during search.
Column filters refine the local result set after data is in the session.
Values from Complex mode may seed column filters; you can still change filters afterward without re-searching.

Examples

Goal	Filter
Only errors	`level` → `ERROR`
One consumer thread	`thread` → `333` or `[JMSConsumer-333]` (substring-style match depending on stored cell text)
Errors or warnings	`level` → select `ERROR` and `WARN` (OR within the column)
Narrow logger package	`logger` → custom value `pl.npsesystem`