README.md in logstash-cli-0.0.2 vs README.md in logstash-cli-0.0.3

- old
+ new

@@ -31,10 +31,12 @@ $ bundle exec bin/logstash-cli ## Commandline Options +### Grep + Usage: logstash-cli grep PATTERN Options: [--index-prefix=INDEX_PREFIX] # Logstash index prefix @@ -57,17 +59,56 @@ # Default: http://localhost:9200 [--last=LAST] # Specify period since now f.i. 1d Search logstash for a pattern +### Tail + +Usage: + logstash-cli tail + +Options: + [--host=HOST] # Host to connect to AMQP + # Default: localhost + --amqpurl, [--url=URL] # Alternate way to specify settings via an AMQP Url f.i. amqp://logstash:foopass@localhost:5672. + This takes precendence over other settings. Note that username and password need to be percentage encoded(URL encoded) in case of special characters + [--auto-delete] # Autodelete Exchange or not + [--vhost=VHOST] # VHost to connect to AMQP + # Default: / + [--persistent] # Persistent Exchange or not + [--ssl] # Enable SSL to connect to AMQP + [--user=USER] # User to connect to AMQP + # Default: logstash + [--meta=META] # Meta Logstash fields to show + # Default: timestamp,type,message + [--format=FORMAT] # Format to use for exporting (plain,csv,json) + # Default: csv + [--key=KEY] # Routing key + # Default: # + [--port=PORT] # Port to connect to AMQP + # Default: 5672 + [--exchange=EXCHANGE] # Exchange name + # Default: rawlogs + [--password=PASSWORD] # Password to connect to AMQP + # Default: foo + [--delim=DELIM] # csv delimiter + # Default: | + [--exchange-type=EXCHANGE_TYPE] # Exchange Type + # Default: direct + [--durable] # Durable Exchange or not + +Stream a live feed via AMQP + + ## Examples $ logstash-cli grep --esurl="http://logger-1.jedi.be:9200" '@message:jedi4ever AND program:sshd' --last 5d --format csv --delim ':' + $ logstash-cli tail --amqpurl="amqp://logger-1.jedi.be:5672" --key="program.sshd" + ## TODO - find a way to query existing instances - specify last 15m - find a way to get the results by streaming instead of loading all in memory (maybe pagination will help here) -- live tailing the output - produce ascii histograms - or sparklines