Package: lstail
LstailA command line tool to query log events from ElasticSearch,
a bit like tail for Logstash/ElasticSearch.Lstail queries ElasticSearch for log events and displays
them on the terminal. Saved Searches from Kibana can be used
for quick access to filters and prepared column configuration.
For more details and usage examples please see the
documentation athttps://lstail.org/.FeaturesFollow mode like intail -fCSV output / exportCan read Saved Searches from ElasticSearch and use their
filters and column setupFlexible configurable output of columns, colors and paddingCan be proxied through Kibana if not direct ElasticSearch connection is possibleWorks with ElasticSearch 2.x - 7.xMade with Python and loveInstallationLstail requires Python 3.9 or newer.
The easiest method is to install directly from pypi using pip:pip install lstailIf you prefer, you can download lstail and install it
directly from source:python setup.py installGet the SourceThe source code is available athttps://github.com/eht16/lstail/.SetupBefore using Lstail, you need to create a config file calledlstail.conf.
Lstail will search forlstail.confin the following locations (in that order):/etc/lstail.conf~/.config/lstail.conflstail.conf (in current working directory)Alternatively, you can specify the name of the config file to be read
using the--configcommand line parameter.An example config file can be found in the sources or online
athttps://raw.githubusercontent.com/eht16/lstail/main/lstail-example.conf.
The important part to modify in the config file is theserversection
which must be edited to point to your ElasticSearch instance to query
data from.For details on all configuration options, please see the documentation:https://lstail.org/.UsageDisplay events (from the configured index pattern) since ten minutes:lstail -r 10mDisplay the last 20 events (from the configured index pattern):lstail -n 20Display all events matching the given query:lstail -q 'host: google.com'List Saved Searches from Kibana:lstail -lDisplay and follow events using the Saved Search "Syslog" (use Ctrl-C to interrupt):lstail -s Syslog -fOverwrite search query for Saved Search "Syslog" (i.e. ignore the query stored
in the Saved Search but use the configured columns):lstail -s Syslog -q program:cronCommand line optionsusage: lstail [-h] [-V] [-d] [-v] [-c FILE] [-f] [-l] [-H] [--csv]
              [-n NUM] [-q QUERY] [-r RANGE] [-s NAME] [--select-saved-search]

optional arguments:
  -h, --help            show this help message and exit
  -V, --version         show version and exit (default: False)
  -d, --debug           enable tracebacks (default: False)
  -v, --verbose         Show own log messages (default: False)
  -c FILE, --config FILE
                        configuration file path (default: None)
  -f, --follow          Constantly fetch new data from ElasticSearch (default: False)
  -l, --list-saved-searches
                        List all saved searches from Kibana (default: False)
  -H, --no-header       Do not print header line before the output (default: False)
  --csv                 Use CSV (comma separated) output (default: False)
  -n NUM, --lines NUM   Output the last NUM lines, instead of the last 10 (default: None)
  -q QUERY, --query QUERY
                        Set/Overwrite the search query (use Lucene query syntax) (default: None)
  -r RANGE, --range RANGE
                        Query events from the last RANGE minutes(m)/hours(h)/days(d) (default: None)
  -s NAME, --saved-search NAME
                        Saved search title as stored in Kibana ("-" to select from a list) (default: None)
  --select-saved-search
                        Interactively select a saved search from a list (default: False)ContributingFound a bug or got a feature request? Please report it athttps://github.com/eht16/lstail/issues.AuthorEnrico Trögerenrico.troeger@uvena.de