Live Tail & Query
Query
To query log data on Parseable, you can use the pb query
command. By default the query command emits JSON on the terminal.
pb query "select * from frontend limit 50" --from=1m --to=now
You can also pipe the query output to other familiar tools like jq
, grep
, cut
, awk
, sed
etc to process the JSON output. For example:
pb query "select * from frontend" --from=1m --to=now | jq . | less
pb query "select host, id, method, status from frontend where status = 500" --from=1m --to=now | jq . | less
pb query "select host, id, method, status from frontend where status = 500" --from=1m --to=now | grep "POST" | jq . | less
Supported flags
Below are the flags supported by query
command.
from
orf
: Used to specify the start time of the query. Takes date as '2023-10-12T07:20:50.52Z' or string like '10m', '1hr'. Default value is '1m'.to
ort
: Used to specify the end time of the query. Takes date as '2023-10-12T07:20:50.52Z' or 'now'. Default value is 'now'.interactive
ori
: Used to enable the interactive mode. This opens up a TUI where you can run queries, edit timestamps, and parse through the query output.
Interactive query mode
You can also run the query command in interactive mode by passing the -i
flag. This will open a prompt where you can type your query. For example:
pb query "select * from frontend" --from=1m --to=now --interactive
Live Tail
pb
allows live tailing log events as well. pb
hooks on to the Parseable websocket endpoint and streams the log events to the terminal. Streaming live tail events is as simple as running the pb tail
command for a given log stream. For example:
pb tail frontend
You can pipe the tail output to other familiar tools like jq
, grep
, cut
, awk
, sed
etc to process the JSON output. For example:
pb tail frontend | jq . | less
pb tail frontend | grep "POST" | jq . | less
pb tail frontend | jq '. | select(.method == "PATCH")'