logstreem query

Run LSQL and format the result for humans or for pipes.

$logstreem query

Runs a query and prints a table, or another format for machines.

Usage

logstreem query [<lsql> | --file <path> | --saved <name>]

Flag	Type	Description
<lsql>	string	The query inline. Quote it.
--file <path>	string	Read the query from a file. Keep long queries in version control.
--saved <name>	string	Run a saved query by name.
--since <duration>	string	Relative start, e.g. `2h`, `7d`. Overrides the query's own filter.
--until <duration>	string	Relative end. Default now.
--format <fmt>	enum	`table`, `json`, `ndjson`, `csv` or `parquet`. Default `table`.
-o, --output <path>	string	Write to a file instead of stdout.
--save <name>	string	Save this query under a name after running it.

Examples

# Inline
logstreem query "['api-gateway-prod'] | summarize count() by service"

# From a file, over the last day
logstreem query --file queries/error-rate.lsql --since 24h

# Into jq
logstreem query --file errors.lsql --format ndjson | jq 'select(.p95 > 1000)'

# Into DuckDB
logstreem query --file errors.lsql --format parquet -o errors.parquet
duckdb -c "select service, sum(errors) from 'errors.parquet' group by 1"

Exit codes make it scriptable

CI gate

#!/usr/bin/env bash
set -euo pipefail

errors=$(logstreem query --json --since 15m \
  "['api-gateway-prod'] | where status >= 500 | count" \
  | jq '.rows[0].count')

if (( errors > 100 )); then
  echo "::error::$errors 5xx in the last 15 minutes — holding the rollout"
  exit 1
fi

Previouslogstreem ingest Nextlogstreem tail