Log expression does not match

[efabrizio75]

🔍 Check for existing issues

• Completed

How is Dozzle deployed?

Standalone Deployment

📦 Dozzle version

v10.0.7

✅ Command used to run Dozzle

services:
  dozzle:
    image: amir20/dozzle:latest
    restart: unless-stopped
    container_name: dozzle
    env_file:
      - ./.env
    security_opt:
      - label:disable
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $HOME/docker/dozzle-data:/data:z
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "/dozzle", "healthcheck"]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 120s

🐛 Describe the bug / provide steps to reproduce it

The Log Filter expression does not match on flat logs.

I have a container with these log (complete entries):

2026-02-24T15:14:34.925855240Z State: Offline
2026-02-24T15:15:57.722216903Z State: Offline
2026-02-24T15:15:57.724979029Z State: Authentication
2026-02-24T15:15:57.829223499Z State: Authentication
2026-02-24T15:15:59.104998648Z State: Online
2026-02-27T22:44:40.941191691Z [ERROR] [connector] Failed to submit analytics events: Unexpected error: error sending request for url (https://analytics.twingate.com/v1/track)
2026-03-01T21:22:09.358324719Z [ERROR] [connector] Failed to submit analytics events: Unexpected error: error sending request for url (https://analytics.twingate.com/v1/track)
2026-03-04T23:25:15.123713922Z State: Offline
2026-03-04T23:26:25.886501835Z State: Offline
2026-03-04T23:26:25.888208432Z State: Authentication
2026-03-04T23:26:25.989503724Z State: Authentication
2026-03-04T23:26:27.031428802Z State: Online

• Value entered in the Log Filter field:
  message contains "Offline"

• Value entered in the Log Filter field:
  level == "error"

There are no logs matched.
I tried several approaches with several containers and I noticed the Log Filter expression fails to match.

The only documentation I found is too limited to understand how to conduct more meaningful tests.

I would be willing to help if given proper guidance on the underlying engines used to perform the matches of expressions to the actual logs.
I do have some dev cycles to spare.

💻 Environment

Client: Docker Engine - Community
Version:    28.1.1
Context:    default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version:  v0.23.0
Path:     /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version:  v2.35.1
Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
Containers: 9
Running: 9
Paused: 0
Stopped: 0
Images: 9
Server Version: 28.1.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
runc version: v1.2.5-0-g59923ef
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
Kernel Version: 5.4.0-225-generic
Operating System: Ubuntu 20.04.6 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.759GiB
Name: cervello
ID: 9cb8c811-b24c-4ffd-ab7f-f739a79335dc
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

📜 Dozzle logs are required for debugging purposes. You may need to enable debug mode. See https://dozzle.dev/guide/debugging.

dozzle-2026-03-05T11-47-46.zip

📸 If applicable, add screenshots to help explain your bug

No response

[amir20]

I am not sure what's happening because both of those expressions worked me.

Probably not a bug on my side.

Make sure your container expression is correct.

Upload screenshots to better help.

[amir20]

Haven't heard back. Going to move this to discussion.