Flik / Practical guides

Incident investigation / context

Find an error and the log lines before it

Use smart find to keep the events surrounding an error, refine the result and return to the original file order.

Updated October 27, 2026 · Flik 0.1.0 · synthetic examples · macOS and Linux

An error line often describes the final symptom. The preceding line may show a failed connection, an exhausted pool or a retry. Filtering down to the word “error” can hide exactly the evidence you need. Flik’s smart find keeps matches together with a configurable amount of context.

Open the synthetic sample

Download the event sample, then open it locally. All names and identifiers are illustrative.

flik events.log

Press g to start at the beginning of a small file. A normal search such as /error narrows the view to matching lines. Smart find starts with a second slash.

Keep the preceding line

//error

Type the expression in the main log view and press Enter. Each matching line is shown with one preceding line. Context-only lines are visually distinguished from matches. They help explain the sequence, but they are not counted as additional occurrences.

Choose a larger window

//3,2:error

This keeps three lines before each match and two after. Overlapping windows are merged without duplicating lines, and the original file order is retained. Increase the window when a failure spans several operations; reduce it when surrounding traffic makes the result harder to read.

For a wider view around one selected result, press Ctrl+G. Inside that context view, n and p move between matches; Esc returns to the file.

Refine the incident

Add an include condition with 3 or an exclude condition with 8. Keep one change at a time so you can see what disappeared. Press x to undo the newest filter, or inspect the stack with Ctrl+F. A correlation ID can narrow the investigation further when unrelated requests share the same error text.

Watch context change the result

Use context as evidence

A line preceding an error is not automatically its cause. Concurrent requests can interleave, timestamps can be missing and services can buffer output. Check identifiers and time order before drawing a conclusion. Before sharing an incident export, review its redaction: recognized keys and patterns cannot guarantee removal of every application-specific secret.