ezgh obs search (--dataset d | --environment e) [--from t] [--to t] [filters…] [flags]Search one dataset’s records: the dataset given with --dataset (environment, ID, slug or name), or the one for the single --environment given. Records from --from (default: an hour ago) to --to (default: now), by event time, newest first unless --order asc. Every filter given must match.
A search answers within a budget. One that would read more is refused (query_too_expensive): run it as an async query (ezgh obs queries start) instead. Pages come --limit records at a time (1 to 100, default 50; --all for every page); a page’s --cursor can be read for 10 minutes, and a next page sends only the cursor and the limit. Records are searchable a few seconds after they’re accepted; the answer says which accepted data it covers.
Part of ezgh obs.
Examples
ezgh obs search --environment production --from 2h --min-severity error
ezgh obs search --dataset dst_4k2m9x0a7qpe --application storefront --contains timeout --all -o json
ezgh obs search --environment staging --attr http.route=/checkout --has-attr user.idFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--all |
boolean | follow nextCursor through every page | |
--application |
strings, comma-separated or repeated | only this ezgh.metadata.application (repeat, or comma-separate) | |
--attr |
string, repeatable | only records whose attribute equals a value: key=value (repeat) | |
--contains |
string | only records whose body contains this text | |
--cursor |
string | start from this page (a previous page’s nextCursor) | |
--dataset |
string | the dataset to search: environment, ID, slug or name | |
--environment |
strings, comma-separated or repeated | only this ezgh.metadata.environment (repeat, or comma-separate) | |
--from |
string | 1h |
records at or after this event time: RFC 3339, a date, or a duration ago (15m, 2h, 7d) |
--has-attr |
string, repeatable | only records that have this attribute (repeat) | |
--limit |
int | 50 |
items per page, 1 to 100 |
--matches |
string | only records whose body matches this RE2 regular expression | |
--min-severity |
string | only records at least this severe: trace, debug, info, warn, error or fatal | |
--order |
string | desc |
desc (newest first) or asc |
--resource-attr |
string, repeatable | only records whose resource attribute equals a value: key=value (repeat) | |
--service |
strings, comma-separated or repeated | only this service.name (repeat, or comma-separate) | |
--span-id |
string | only records of this span (16 hex digits) | |
--to |
string | records before this event time (default: now) | |
--trace-id |
string | only records of this trace (32 hex digits) |
This command also takes the global flags.