ezgh obs queries start (--dataset d… | --environment e…) [--from t] [--to t] [filters…] [--group-by f…] [--wait] [flags]Start an async query over 1 to 10 of the project’s datasets: each --dataset (environment, ID, slug or name), or the dataset of each --environment. It takes the same filters as search, reads from --from (default: 24 hours ago) to --to (default: now) by event time, and may read more and take longer than a search. It keeps up to --limit records (1 to 100000, default 10000). With --group-by it counts records by application, environment, severity or service instead (at most 10000 groups).
ezgh prints the query and returns; --wait waits for it to finish instead (Ctrl-C cancels it). Read what it found with ezgh obs queries results.
Part of ezgh obs queries.
Examples
ezgh obs queries start --environment production --from 30d --contains "payment declined"
ezgh obs queries start --environment production --environment staging --group-by application,severity --waitFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--application |
strings, comma-separated or repeated | only this ezgh.metadata.application (repeat, or comma-separate) | |
--attr |
string, repeatable | only records whose attribute equals a value: key=value (repeat) | |
--contains |
string | only records whose body contains this text | |
--dataset |
string, repeatable | a dataset to read: environment, ID, slug or name (repeat) | |
--environment |
strings, comma-separated or repeated | only this ezgh.metadata.environment (repeat, or comma-separate) | |
--from |
string | 24h |
records at or after this event time: RFC 3339, a date, or a duration ago (15m, 2h, 7d) |
--group-by |
strings, comma-separated or repeated | count records by application, environment, severity or service (repeat, or comma-separate) | |
--has-attr |
string, repeatable | only records that have this attribute (repeat) | |
--limit |
int | the most records to keep, 1 to 100000 (default: the service’s, 10000) | |
--matches |
string | only records whose body matches this RE2 regular expression | |
--min-severity |
string | only records at least this severe: trace, debug, info, warn, error or fatal | |
--order |
string | desc |
desc (newest first) or asc |
--resource-attr |
string, repeatable | only records whose resource attribute equals a value: key=value (repeat) | |
--service |
strings, comma-separated or repeated | only this service.name (repeat, or comma-separate) | |
--span-id |
string | only records of this span (16 hex digits) | |
--to |
string | records before this event time (default: now) | |
--trace-id |
string | only records of this trace (32 hex digits) | |
--wait |
boolean | wait for the query to finish; Ctrl-C cancels it |
This command also takes the global flags.