A user interface for an event monitor that monitors a data stream receives an event message having at least one level of categorization, adds the event message to a log file, produces an alert status corresponding to a value of a component of the at least one level of categorization, selects the component of the at least one level of categorization, creates a filter according to filter criteria corresponding to the selected component of the at least one level of categorization, filters the log file to produce a filtered log file, and outputs the filtered log file containing event messages corresponding to the selected component of the at least one level of categorization.