sazabi logs

sazabi logs — Ask about, query, stream, and forward logs. Subcommands: tail, ask, query, forward.

sazabi logs

Ask about, query, stream, and forward logs

sazabi logs <subcommand>

sazabi logs tail  # Tail all logs in real time
sazabi logs tail --severities ERROR,WARN  # Tail only errors and warnings
sazabi logs ask "errors from api in the last hour"  # Ask about stored logs
sazabi logs query execute <queryId> --since 24h  # Execute an answer's query again
sazabi logs forward --file app.log  # Forward from file

sazabi logs tail

Stream logs from the active project in real time

sazabi logs tail [options]

sazabi logs tail  # Tail all logs in real time
sazabi logs tail --severities ERROR,WARN  # Tail only errors and warnings
sazabi logs tail --services api,worker  # Tail specific services
sazabi logs tail --environments production,staging  # Tail specific environments
sazabi logs tail --search "database"  # Tail logs matching search term
sazabi logs tail --attribute user.id=42  # Tail logs with an exact attribute value
sazabi logs tail --attrs model,prompt  # Show selected attributes per line
sazabi logs tail --attrs all  # Show every attribute per line
sazabi logs tail --json  # Output as JSON

sazabi logs ask

Ask a natural-language question about stored logs

Answers from the project's stored logs alone: a count, a breakdown, a series over time, matching lines, or for an overview question the kinds of lines the window holds. A question is at most 2,000 characters. Prints the answer in one sentence, then Results (top 50): one table of the query's own results, then Window:, Query ID: and Question: on their own lines. When more than 50 matched it ends in the command that fetches the rest with no model involved (sazabi logs query execute <queryId>), which pages with --cursor.

Ask in any language: the answer is written in it. The period the question names is read from it on this machine's clock (the last 6 hours, this afternoon, since midnight, yesterday, this hour against the previous hour); --since or --from/--to replace it, and the answer says so. A period that cannot be read is said to be, and the last hour is read instead.

The table's columns are fixed by the kind of answer: an overview's kinds of lines as Message, Count, Previous and Services; a breakdown as its field then its metrics; matching lines as Time, Service, Severity and Message; a count as the number alone. When nothing matches, the table says so and Read as: states how the question was read. --json prints the whole response, results included.

A question is answered, or reported as taking too long, within about a minute; the CLI waits up to 2 minutes for a response, then stops waiting and says so.

sazabi logs ask <question> [options]

sazabi logs ask "p95 latency per route in the last 6 hours"  # Get a plain-language answer
sazabi logs ask "errors from api" --since 1h  # The answer and the newest matching lines
sazabi logs ask "过去6小时api服务有多少错误?"  # Ask in any language; the answer is in it
sazabi logs ask "did api log more errors this hour than the previous hour?"  # Compare two periods
TZ=UTC sazabi logs ask "errors since midnight"  # Read the period in UTC rather than local time
sazabi logs ask "errors from api" --json  # The whole response, with the query id

sazabi logs query

List, read and run your stored log queries, or run a spec

sazabi logs query <subcommand>

sazabi logs query list  # Your recent log queries, newest first
sazabi logs query get <queryId>  # One query: its question, window and spec
sazabi logs query execute <queryId> --since 24h  # Execute an earlier answer's query over the last day
sazabi logs query execute <queryId> --cursor <token>  # The next page of lines, as the Next: line printed it
sazabi logs query execute @query.json --since 6h  # Execute a spec from a file
sazabi logs query schema > spec.schema.json  # The spec's JSON Schema

sazabi logs query list

List the project's log queries, newest first

Lists every log query asked with sazabi logs ask and every spec executed with sazabi logs query execute, newest first: its query id, when it was asked on this machine's clock, and its question. Executions of an earlier query by its id are not listed; each names the query it executed as its parent and can be read with sazabi logs query get.

Listing executes nothing and reads no logs. --json adds each query's window, parent and results kind, with createdAt as ISO-8601 UTC.

sazabi logs query list [options]

sazabi logs query list  # Your 20 most recent log queries
sazabi logs query list --limit 100 --json  # More of them, as JSON

sazabi logs query get

Show one log query: its question, window and spec

Shows a stored log query without running it: the question it answered (or a spec's plain-words reading), how it was read, the times it read, the kind of results it returned, and its log query spec.

Run it again with sazabi logs query execute <queryId>. Save its spec with --json to change it and run it with sazabi logs query execute @file.json.

sazabi logs query get <queryId> [options]

sazabi logs query get <queryId>  # Show a query
sazabi logs query get <queryId> --json | jq .spec > query.json  # Save its spec to run or edit

sazabi logs query execute

Run a saved query by id or a query spec

Executes a log query with no model involved and prints its results: Results (top 50): one table in the same shape sazabi logs ask prints, then Window: and Query ID: on their own lines. Give the query id printed by sazabi logs ask (or by an earlier execution), or a spec: as JSON in one quoted argument, as @file.json, or as - to read it from standard input.

A query id reads the same times its answer read, however long ago that was, so the results match the answer, unless --since or --from/--to name another window. To ask the same question again now, give its period with --since (for example --since 6h), which ends at the current time. A spec executes over --since or --from/--to, else the last hour.

Matching lines page: --limit is the page size (default 50, at most 5,000), and when more lines matched the output ends in Next: --cursor <token>; pass that token as --cursor, with no window of its own, for the next page over the same times. A breakdown, a series or a count returns at most --limit groups and never pages. The counts beside the results cover everything that matched.

Query ID: is the id you passed. --json carries it as queryId, this execution's own id as executionId (which sazabi logs query get reads), and nextCursor when a next page exists. A spec execution prints its new query id. The CLI waits up to 2 minutes for the result.

A spec selects lines with predicate, groups them by dimensions, and computes a measure shaped as output: table, series, or evidence (the matching lines). sazabi logs query schema prints its JSON Schema. A spec the service cannot execute is refused with each problem and where it is.

Lines per service, as a spec: {"version":2,"predicate":{"op":"and","children":[]},"dimensions":[{"kind":"service"}],"measure":{"op":"count"},"output":"table"}

sazabi logs query execute <queryId | spec JSON | @file.json | -> [options]

sazabi logs query execute <queryId>  # Execute over the same times the answer read
sazabi logs query execute <queryId> --since 6h  # The same question over the last 6 hours, as of now
sazabi logs query execute <queryId> --since 24h --limit 10  # Execute over the last day, top 10
sazabi logs query execute <queryId> --cursor <token>  # The next page of lines, as the Next: line printed it
sazabi logs query execute "$(cat per-service.json)" --since 6h  # A spec as one JSON argument
sazabi logs query execute @errors.json --since 24h --json  # A spec from a file, the whole response as JSON
cat query.json | sazabi logs query execute -  # A spec from standard input

sazabi logs query schema

Print the JSON Schema of the spec logs query execute runs

Prints the log query spec's JSON Schema as JSON, for writing a spec to run with sazabi logs query execute.

sazabi logs query schema [options]

sazabi logs query schema  # Print the spec's JSON Schema
sazabi logs query schema > spec.schema.json  # Save it for an editor or a validator

sazabi logs forward

Forward plaintext logs to the active project

sazabi logs forward [options]

echo "Log message" | sazabi logs forward  # Forward from stdin
sazabi logs forward --file app.log  # Forward from file
sazabi logs forward --file app.log --follow  # Forward file with tail -f behavior
sazabi logs forward --file app.log --batch-size 50  # Forward with custom batch size

Reading query results

logs ask prints the answer, then Results (top 50): with the table it was written from, then Window:, Query ID: and Question: lines; when more than 50 matched it ends with the logs query execute <queryId> command for getting the rest. logs query execute <queryId> runs the same query again without asking the question again, over the same window or a new one; it starts at the first page, shows up to --limit rows (default 50, at most 5,000), and continues to the next page with the --cursor token its Next: line prints. logs query execute also runs a log query spec given as JSON, @file.json or - (standard input); logs query schema prints the spec's JSON Schema. --json returns the whole response.