README.md in logstash-cli-0.0.2 vs README.md in logstash-cli-0.0.3
- old
+ new
@@ -31,10 +31,12 @@
$ bundle exec bin/logstash-cli
## Commandline Options
+### Grep
+
Usage:
logstash-cli grep PATTERN
Options:
[--index-prefix=INDEX_PREFIX] # Logstash index prefix
@@ -57,17 +59,56 @@
# Default: http://localhost:9200
[--last=LAST] # Specify period since now f.i. 1d
Search logstash for a pattern
+### Tail
+
+Usage:
+ logstash-cli tail
+
+Options:
+ [--host=HOST] # Host to connect to AMQP
+ # Default: localhost
+ --amqpurl, [--url=URL] # Alternate way to specify settings via an AMQP Url f.i. amqp://logstash:foopass@localhost:5672.
+ This takes precendence over other settings. Note that username and password need to be percentage encoded(URL encoded) in case of special characters
+ [--auto-delete] # Autodelete Exchange or not
+ [--vhost=VHOST] # VHost to connect to AMQP
+ # Default: /
+ [--persistent] # Persistent Exchange or not
+ [--ssl] # Enable SSL to connect to AMQP
+ [--user=USER] # User to connect to AMQP
+ # Default: logstash
+ [--meta=META] # Meta Logstash fields to show
+ # Default: timestamp,type,message
+ [--format=FORMAT] # Format to use for exporting (plain,csv,json)
+ # Default: csv
+ [--key=KEY] # Routing key
+ # Default: #
+ [--port=PORT] # Port to connect to AMQP
+ # Default: 5672
+ [--exchange=EXCHANGE] # Exchange name
+ # Default: rawlogs
+ [--password=PASSWORD] # Password to connect to AMQP
+ # Default: foo
+ [--delim=DELIM] # csv delimiter
+ # Default: |
+ [--exchange-type=EXCHANGE_TYPE] # Exchange Type
+ # Default: direct
+ [--durable] # Durable Exchange or not
+
+Stream a live feed via AMQP
+
+
## Examples
$ logstash-cli grep --esurl="http://logger-1.jedi.be:9200" '@message:jedi4ever AND program:sshd' --last 5d --format csv --delim ':'
+ $ logstash-cli tail --amqpurl="amqp://logger-1.jedi.be:5672" --key="program.sshd"
+
## TODO
- find a way to query existing instances
- specify last 15m
- find a way to get the results by streaming instead of loading all in memory (maybe pagination will help here)
-- live tailing the output
- produce ascii histograms
- or sparklines