Live Tail & Query

Query

To query log data on Parseable, you can use the pb query command. By default the query command emits JSON on the terminal.

pb query "select * from frontend limit 50" --from=1m --to=now

You can also pipe the query output to other familiar tools like jq, grep, cut, awk, sed etc to process the JSON output. For example:

pb query "select * from frontend" --from=1m --to=now | jq . | less
pb query "select host, id, method, status from frontend where status = 500" --from=1m --to=now | jq . | less
pb query "select host, id, method, status from frontend where status = 500" --from=1m --to=now | grep "POST" | jq . | less

Supported flags

Below are the flags supported by query command.

• from or f: Used to specify the start time of the query. Takes date as '2023-10-12T07:20:50.52Z' or string like '10m', '1hr'. Default value is '1m'.
• to or t: Used to specify the end time of the query. Takes date as '2023-10-12T07:20:50.52Z' or 'now'. Default value is 'now'.
• interactive or i: Used to enable the interactive mode. This opens up a TUI where you can run queries, edit timestamps, and parse through the query output.

Interactive query mode

You can also run the query command in interactive mode by passing the -i flag. This will open a prompt where you can type your query. For example:

pb query "select * from frontend" --from=1m --to=now --interactive

Live Tail

pb allows live tailing log events as well. pb hooks on to the Parseable websocket endpoint and streams the log events to the terminal. Streaming live tail events is as simple as running the pb tail command for a given log stream. For example:

pb tail frontend

You can pipe the tail output to other familiar tools like jq, grep, cut, awk, sed etc to process the JSON output. For example:

pb tail frontend | jq . | less
pb tail frontend | grep "POST" | jq . | less
pb tail frontend | jq '. | select(.method == "PATCH")'