search

blue-yonder / bonfire

A CLI Graylog Client with Follow Mode
BSD 3-Clause "New" or "Revised" License
72 stars 26 forks source link
cli graylog

readme

======= bonfire

Bonfire is a command line interface to query Graylog searches via the REST API. It tries to emulate the feeling of using tail on a local file.

Usage

Examples::

> bonfire -h logserver -u jdoe -@ "10 minutes ago" "*"
...

> bonfire -h logserver -u jdoe -f "source:localhost AND level:2"
...

Bonfire usage::

Usage: bonfire [OPTIONS] [QUERY]

  Bonfire - An interactive graylog cli client

Options:
  --node TEXT                     Label of a preconfigured graylog node
  -h, --host TEXT                 Your graylog node's host
  -s, --tls                       Use HTTPS
  --port INTEGER                  Your graylog port (default: 12900)
  --endpoint TEXT                 Your graylog API endpoint e.g /api (default:
                                  /)
  -u, --username TEXT             Your graylog username
  -p, --password TEXT             Your graylog password (default: prompt)
  -k, --keyring / -nk, --no-keyring
                                  Use keyring to store/retrieve password
  -@, --search-from TEXT          Query range from
  -#, --search-to TEXT            Query range to (default: now)
  -t, --tail                      Show the last n lines for the query
                                  (default)
  -d, --dump                      Print the query result as a csv
  -f, --follow                    Poll the logging server for new logs
                                  matching the query (sets search from to now,
                                  limit to None)
  -l, --interval INTEGER          Polling interval in ms (default: 1000)
  -n, --limit INTEGER             Limit the number of results (default: 10)
  -a, --latency INTEGER           Latency of polling queries (default: 2)
  -r, --stream TEXT               Stream ID of the stream to query (default:
                                  no stream filter)
  -e, --field TEXT                Fields to include in the query result
  -x, --template-option TEXT      Template options for the stored query
  -s, --sort TEXT                 Field used for sorting (default: timestamp)
  --asc / --desc                  Sort ascending / descending
  --help                          Show this message and exit.

Configuration

Bonfire can be configured. It will look for a ~/.bonfire.cfg or a bonfire.cfg (in the current directory). The configuration file can specify API nodes. If no host is specified a node with the name default will be used. You can also configure queries which can be referenced by starting your query with a colon::

[node:default]
host=1.2.3.4
port=12900
endpoint=/
username=jdoe

[node:dev]
host=4.3.2.1
port=9000
endpoint=/api
username=jdoe
password=H4rrH4rrB0bba

[query:example]
query=facility:*foo* AND source:*bar*
from=2015-03-01 15:00:00
limit=100
fields=message,name,facility,source

Now you can run queries via such as::

> bonfire --node=dev :example
... runs the example query on the node dev

> bonfire :example
... runs the example query on the default node

Query Templates

Options

Queries

Testing

Cf. the travis script for running tests. Make sure you disable proxies / set noproxy if you're using a proxy, to be able to reach the test dummy server (called dummyserver), e.g.::

env no_proxy=dummyhost python setup.py test

Known Bugs

Development

Once you want to release a new version, do the following:

Note that if you have several different versions in dist, you might want to specify which one you want to publish.

Release Notes