update docs for regex filter

Author: Paulo Remoli

docs/src/filtering/index.md

@@ -20,8 +20,8 @@ Filters are the primary way to narrow the log view. They are layered: include pa
 **No filters:** All lines are shown.
 
 Both filter types support:
-- **Literal strings** — fast multi-pattern matching via Aho-Corasick
-- **Regular expressions** — full regex syntax via the `regex` crate, opt-in with `--regex` / `-r`
+- **Text search** — fast multi-pattern matching
+- **Regular expressions** — full regex syntax, opt-in with `--regex` / `-r`
 
 ## Filter Persistence
 

docs/src/filtering/text-filters.md

@@ -14,27 +14,33 @@ Text filters match against the raw content of each log line.
 :exclude <pattern>      # hide lines matching pattern
 ```
 
-## Pattern Matching
+## Text Search
 
-logana uses two matching strategies, selected explicitly:
+The default mode. Fast multi-pattern scanning. Case-sensitive. Multi-word patterns work without quotes.
 
-**Literal matching** (default) — fast multi-pattern scanning via Aho-Corasick. Case-sensitive.
+```sh
+:filter ERROR
+:filter connection refused
+:filter 500 Internal Server Error
+:filter database connection pool exhausted
+```
+
+## Regex Filters
 
-**Regex matching** — opt-in via `--regex` / `-r`. Uses the `regex` crate with full regex syntax.
+Opt in with `--regex` / `-r`. Supports full regex syntax. Words after `-r` are joined, so spaces in the pattern do not need quoting.
 
 ```sh
-:filter ERROR                       # literal — fast
-:filter connection refused          # multi-word literal (no quotes needed)
-:filter -r "ERR(OR)?"               # regex — matches ERR or ERROR
-:filter -r "\d{3} \d+"             # regex — HTTP status + bytes
-:filter -r "^2024-"                 # regex — lines starting with date
+:filter -r (ERROR|WARN)                      # errors and warnings together
+:filter -r (timeout|connection refused)      # any connectivity failure
+:filter -r authentication failed.*user       # auth failures with user context
+:filter -r response time: [5-9]\d{3}ms      # slow responses over 5 seconds
 ```
 
-> **Flag ordering:** Options like `--regex`, `--fg`, `--bg`, and `-l` must be placed **before** the pattern. Everything after the first pattern word is treated as part of the pattern.
+> **Flag ordering:** Options (`-r`, `--fg`, `--bg`, `-l`, `--field`) must appear **before** the pattern. Everything after the first pattern word is part of the pattern.
 >
 > ```sh
-> :filter --fg red -r "timeout.*retry"   # correct
-> :filter "timeout.*retry" --fg red      # incorrect — "--fg" becomes part of the pattern
+> :filter --fg red -r timeout.*retry   # correct
+> :filter timeout.*retry --fg red      # wrong — "--fg" becomes part of the pattern
 > ```
 
 ## Multiple Filters

docs/src/search.md

@@ -20,13 +20,13 @@ Press `/` or `?` to open the search bar at the bottom of the screen. Type your q
 
 ## Pattern Syntax
 
-Search uses full regex syntax (via the `regex` crate). Examples:
+Search uses full regex syntax. Examples:
 
 ```
-/ERROR                  plain literal
-/connection.*refused    regex
-/\d{3} \d+              HTTP status + bytes
-/^2024-03               lines starting with date prefix
+/NullPointerException              plain text
+/user 42 .* failed                 regex — activity for a specific user
+/POST /api/orders.* 5\d\d          regex — failed order requests
+/^2024-06-15T14                    lines from a specific hour
 ```
 
 ## Case Sensitivity

src/commands/info.rs

@@ -7,13 +7,13 @@ pub struct CommandInfo {
 pub const COMMANDS: &[CommandInfo] = &[
     CommandInfo {
         name: "filter",
-        usage: "filter [--field] [-l] [--fg <color>] [--bg <color>] <pattern>",
-        description: "Add an include filter. With --field, pattern is key=value scoped to a parsed field. e.g. filter --fg Red error, filter --field level=error, filter --field component=auth",
+        usage: "filter [-r] [-l] [--fg <color>] [--bg <color>] [--field <key>=<value>] <pattern>",
+        description: "Add an include filter. e.g. filter ERROR, filter connection refused, filter -r \"ERR(OR)?\", filter --field level=error",
     },
     CommandInfo {
         name: "exclude",
-        usage: "exclude [--field] <pattern>",
-        description: "Add an exclude filter. With --field, pattern is key=value scoped to a parsed field. e.g. exclude debug, exclude --field level=debug",
+        usage: "exclude [-r] [--field <key>=<value>] <pattern>",
+        description: "Add an exclude filter. e.g. exclude debug, exclude connection refused, exclude -r \"health.?check\", exclude --field level=debug",
     },
     CommandInfo {
         name: "set-color",