> ## Documentation Index > Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt > Use this file to discover all available pages before exploring further. # sazabi logs > Command reference for sazabi logs. `sazabi logs` — Ask about, query, and forward logs. Subcommands: `ask`, `query`, `forward`. ## `sazabi logs` Ask about, query, and forward logs ```txt theme={"system"} sazabi logs ``` ```bash theme={"system"} sazabi logs ask "errors from api in the last hour" # Ask about stored logs sazabi logs query execute --since 24h # Execute an answer's query again sazabi logs forward --file app.log # Forward from file ``` ### `sazabi logs ask` Ask a natural-language question about stored logs Answers from the project's stored logs alone: a count, a breakdown, a series over time, matching lines, or for an overview question the kinds of lines the window holds. A question is at most 2,000 characters. Prints the answer in one sentence, then Results (top 50): one table of the query's own results, then Window:, Query ID: and Question: on their own lines. When more than 50 matched it ends in the command that fetches the rest with no model involved (sazabi logs query execute \), which pages with --cursor. Ask in any language: the answer is written in it. The period the question names is read from it on this machine's clock (the last 6 hours, this afternoon, since midnight, yesterday, this hour against the previous hour); --since or --from/--to replace it, and the answer says so. A period that cannot be read is said to be, and the last hour is read instead. The table's columns are fixed by the kind of answer: an overview's kinds of lines as Message, Count, Previous and Services; a breakdown as its field then its metrics; matching lines as Time, Service, Severity and Message; a count as the number alone. When nothing matches, the table says so and Read as: states how the question was read. --json prints the whole response, results included. A question is answered, or reported as taking too long, within about a minute; the CLI waits up to 2 minutes for a response, then stops waiting and says so. ```txt theme={"system"} sazabi logs ask [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) | | `--api-base-url` | string | No | Override API base URL | | `--json` | boolean | No | Output as JSON | | `--project-id` | string | No | Override project ID (default: active project) | | `--since` | string | No | Relative window in whole minutes, e.g. 30m, 6h, 7d, in place of the period the question names (default: that period, else 1h) | | `--from` | string | No | Absolute window start, ISO-8601 (with --to), in place of the period the question names | | `--to` | string | No | Absolute window end, ISO-8601 (with --from) | ```bash theme={"system"} sazabi logs ask "p95 latency per route in the last 6 hours" # Get a plain-language answer sazabi logs ask "errors from api" --since 1h # The answer and the newest matching lines sazabi logs ask "过去6小时api服务有多少错误?" # Ask in any language; the answer is in it sazabi logs ask "did api log more errors this hour than the previous hour?" # Compare two periods TZ=UTC sazabi logs ask "errors since midnight" # Read the period in UTC rather than local time sazabi logs ask "errors from api" --json # The whole response, with the query id ``` ### `sazabi logs query` List, read and run your stored log queries, or run a spec ```txt theme={"system"} sazabi logs query ``` ```bash theme={"system"} sazabi logs query list # Your recent log queries, newest first sazabi logs query get # One query: its question, window and spec sazabi logs query execute --since 24h # Execute an earlier answer's query over the last day sazabi logs query execute --cursor # The next page of lines, as the Next: line printed it sazabi logs query execute @query.json --since 6h # Execute a spec from a file sazabi logs query schema > spec.schema.json # The spec's JSON Schema ``` #### `sazabi logs query list` List the project's log queries, newest first Lists every log query asked with sazabi logs ask and every spec executed with sazabi logs query execute, newest first: its query id, when it was asked on this machine's clock, and its question. Executions of an earlier query by its id are not listed; each names the query it executed as its parent and can be read with sazabi logs query get. Listing executes nothing and reads no logs. --json adds each query's window, parent and results kind, with createdAt as ISO-8601 UTC. ```txt theme={"system"} sazabi logs query list [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) | | `--api-base-url` | string | No | Override API base URL | | `--json` | boolean | No | Output as JSON | | `--project-id` | string | No | Override project ID (default: active project) | | `--limit` | string | No | Maximum number of queries to return (default: 20, max: 100) | | `--cursor` | string | No | Pagination cursor from previous response | ```bash theme={"system"} sazabi logs query list # Your 20 most recent log queries sazabi logs query list --limit 100 --json # More of them, as JSON ``` #### `sazabi logs query get` Show one log query: its question, window and spec Shows a stored log query without running it: the question it answered (or a spec's plain-words reading), how it was read, the times it read, the kind of results it returned, and its log query spec. Run it again with sazabi logs query execute \. Save its spec with --json to change it and run it with sazabi logs query execute @file.json. ```txt theme={"system"} sazabi logs query get [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) | | `--api-base-url` | string | No | Override API base URL | | `--json` | boolean | No | Output as JSON | | `--project-id` | string | No | Override project ID (default: active project) | ```bash theme={"system"} sazabi logs query get # Show a query sazabi logs query get --json | jq .spec > query.json # Save its spec to run or edit ``` #### `sazabi logs query execute` Run a saved query by id or a query spec Executes a log query with no model involved and prints its results: Results (top 50): one table in the same shape sazabi logs ask prints, then Window: and Query ID: on their own lines. Give the query id printed by sazabi logs ask (or by an earlier execution), or a spec: as JSON in one quoted argument, as @file.json, or as - to read it from standard input. A query id reads the same times its answer read, however long ago that was, so the results match the answer, unless --since or --from/--to name another window. To ask the same question again now, give its period with --since (for example --since 6h), which ends at the current time. A spec executes over --since or --from/--to, else the last hour. Matching lines page: --limit is the page size (default 50, at most 5,000), and when more lines matched the output ends in Next: --cursor \; pass that token as --cursor, with no window of its own, for the next page over the same times. A breakdown, a series or a count returns at most --limit groups and never pages. The counts beside the results cover everything that matched. Query ID: is the id you passed. --json carries it as queryId, this execution's own id as executionId (which sazabi logs query get reads), and nextCursor when a next page exists. A spec execution prints its new query id. The CLI waits up to 2 minutes for the result. A spec selects lines with predicate, groups them by dimensions, and computes a measure shaped as output: table, series, or evidence (the matching lines). sazabi logs query schema prints its JSON Schema. A spec the service cannot execute is refused with each problem and where it is. Lines per service, as a spec: \{"version":2,"predicate":\{"op":"and","children":\[]},"dimensions":\[\{"kind":"service"}],"measure":\{"op":"count"},"output":"table"} ```txt theme={"system"} sazabi logs query execute [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) | | `--api-base-url` | string | No | Override API base URL | | `--json` | boolean | No | Output as JSON | | `--project-id` | string | No | Override project ID (default: active project) | | `--since` | string | No | Relative window ending now, in whole minutes, e.g. 30m, 6h, 7d (default: the times a query id read, or 1h for a spec) | | `--from` | string | No | Absolute window start, ISO-8601 (with --to) | | `--to` | string | No | Absolute window end, ISO-8601 (with --from) | | `--limit` | string | No | Page size: most rows, groups or points shown (1-5000, default 50); counts cover everything that matched | | `--cursor` | string | No | The token an earlier page printed after Next:, for the next page of lines over the same times | ```bash theme={"system"} sazabi logs query execute # Execute over the same times the answer read sazabi logs query execute --since 6h # The same question over the last 6 hours, as of now sazabi logs query execute --since 24h --limit 10 # Execute over the last day, top 10 sazabi logs query execute --cursor # The next page of lines, as the Next: line printed it sazabi logs query execute "$(cat per-service.json)" --since 6h # A spec as one JSON argument sazabi logs query execute @errors.json --since 24h --json # A spec from a file, the whole response as JSON cat query.json | sazabi logs query execute - # A spec from standard input ``` #### `sazabi logs query schema` Print the JSON Schema of the spec logs query execute runs Prints the log query spec's JSON Schema as JSON, for writing a spec to run with sazabi logs query execute. ```txt theme={"system"} sazabi logs query schema [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--json` | boolean | No | Output as JSON (the schema is always JSON) | ```bash theme={"system"} sazabi logs query schema # Print the spec's JSON Schema sazabi logs query schema > spec.schema.json # Save it for an editor or a validator ``` ### `sazabi logs forward` Forward plaintext logs to the active project ```txt theme={"system"} sazabi logs forward [options] ``` | Flag | Type | Required | Description | | - | - | - | - | | `--token` | string | No | Override token (prefer SAZABI\_TOKEN; arguments are visible to other local users) | | `--api-base-url` | string | No | Override API base URL | | `--json` | boolean | No | Output a final JSON summary | | `--file`, `-f` | string | No | Read from file instead of stdin | | `--follow` | boolean | No | Follow file for new lines (like tail -f) | | `--batch-size` | string | No | Number of logs to batch before sending (default: 100) | | `--intake-base-url` | string | No | Override intake base URL | | `--public-key` | string | No | Use this public key value (skip creating/storing) | | `--service` | string | No | Set OTLP service.name for forwarded lines (default: sazabi-cli) | | `--attribute` | string | No | Attach a log attribute as key=value. Repeat for multiple attributes. | | `--region` | string | No | Override project region | ```bash theme={"system"} echo "Log message" | sazabi logs forward # Forward from stdin sazabi logs forward --file app.log # Forward from file sazabi logs forward --file app.log --follow # Forward file with tail -f behavior sazabi logs forward --file app.log --batch-size 50 # Forward with custom batch size ``` ### Reading query results `logs ask` prints the answer, then `Results (top 50):` with the table it was written from, then `Window:`, `Query ID:` and `Question:` lines; when more than 50 matched it ends with the `logs query execute ` command for getting the rest. `logs query execute ` runs the same query again without asking the question again, over the same window or a new one; it starts at the first page, shows up to `--limit` rows (default 50, at most 5,000), and continues to the next page with the `--cursor` token its `Next:` line prints. `logs query execute` also runs a log query spec given as JSON, `@file.json` or `-` (standard input); `logs query schema` prints the spec's JSON Schema. `--json` returns the whole response. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.