### Install Nerdlog with Go install

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Installs the Nerdlog binary using the `go install` command. This method allows installing the latest release or the latest master branch.

```go
go install github.com/dimonomid/nerdlog/cmd/nerdlog@latest
```

```go
go install github.com/dimonomid/nerdlog/cmd/nerdlog@master
```

--------------------------------

### Install Nerdlog with Make

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Installs the Nerdlog binary to /usr/local/bin using the `make` command. Alternatively, it can be built and run directly without installation.

```bash
make && sudo make install
```

```bash
make && bin/nerdlog
```

--------------------------------

### Install X11 Dev Package on Ubuntu

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Installs the necessary X11 development package on Ubuntu systems, required for clipboard access by Nerdlog's underlying library.

```bash
sudo apt install libx11-dev
```

--------------------------------

### Apache Log Entry Example

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/04_apache/want_log_resp_01_initial.txt

Example of a single Apache log entry, including timestamp, severity, file path, and the log message itself. This format is typical for web server logs.

```text
2025-06-03T13:45:27.123456000Z,F,/tmp/nerdlog_core_test_output/04_apache/lstreams/testhost-3/logfile,000001,000001,----,[core:notice] [pid 1234] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
```

--------------------------------

### Nerdlog Configuration File (logstreams.yaml)

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Example of the nerdlog configuration file for defining custom logstreams, including hostname, port, user, and specific log files.

```yaml
log_streams:
  myhost-01:
    hostname: actualhost1.com
    port: 1234
    user: myuser
    log_files:
      - /some/custom/logfile
  myhost-02:
    hostname: actualhost2.com
    port: 7890
    user: myuser
    log_files:
      - /some/custom/logfile
```

--------------------------------

### Manage Options

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Allows users to get the current value of an option or set an option to a new value. A full list of supported options is available via a separate link.

```shell
:set option?
```

```shell
:set option=value
```

--------------------------------

### Nerdlog Awk Pattern Input Examples

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Provides examples of valid Awk patterns that can be used to filter logs in Nerdlog. These patterns support simple regular expressions and more complex conditional logic.

```Nerdlog Syntax
Simple regexp: `/foo bar/`
```

```Nerdlog Syntax
Regexps with complex conditions: `( /foo bar/ || /other stuff/ ) && !/baz/`
```

--------------------------------

### Nerdlog Field Selection Syntax

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_05_after_restart.txt

Illustrates the syntax for selecting specific fields from log entries. Allows aliasing fields using 'AS' and selecting all remaining fields with '*'.

```text
Select field expression. Example: "time STICKY, message, lstream, level_name AS level, *"
time STICKY, lstream, message, *
```

--------------------------------

### Awk Pattern Examples for Log Filtering

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_01_initial.txt

Provides examples of awk patterns used for filtering log entries. These patterns can include simple string matches, regular expressions, and logical combinations of conditions.

```awk
/foo bar/
```

```awk
( /foo bar/ || /other stuff/ ) && !/baz/
```

--------------------------------

### Awk Pattern Matching Example

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/faq.md

Demonstrates the use of Awk's pattern matching capabilities, including combining patterns with boolean operators for complex filtering. This highlights the flexibility and readability of Awk for log processing.

```awk
/foo/ && !/bar/ && (/this/ || /that/)
```

--------------------------------

### Apache SSL Warning Log Entry

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/04_apache/want_log_resp_01_initial.txt

Example of an Apache log entry related to SSL warnings, specifically concerning RSA server certificates. This is useful for diagnosing TLS/SSL configuration issues.

```text
2025-06-03T13:50:00.000123000Z,F,/tmp/nerdlog_core_test_output/04_apache/lstreams/testhost-3/logfile,000005,000005,warn,[ssl:warn] [pid 1234] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
```

--------------------------------

### SSH Config Example for Host Aliases

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Illustrates how entries in the `~/.ssh/config` file can be used to define aliases for hosts, including user, hostname, and port. This simplifies connection details.

```text
Host myhost-01
  User myuser
  HostName actualhost1.com
  Port 1234

Host myhost-02
  User myuser
  HostName actualhost2.com
  Port 7890
```

--------------------------------

### Filtering Logs with Bash Command

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/03_may_jun/want_log_resp_01_initial.txt

This snippet demonstrates a bash command used to filter log files based on a specified time range. It utilizes 'tail' to get data from a starting offset and 'head' to limit the output by size. The command is designed to extract relevant log entries from a file.

```bash
bash -c 'tail -c +8680 /tmp/nerdlog_core_test_output/03_may_jun/lstreams/testhost-3/logfile.1 | head -c 1054'
```

--------------------------------

### Specify Multiple Log Files in Nerdlog

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/limitations.md

This example shows how to specify multiple log files for Nerdlog to read from a server, including a previous log file.

```nerdlog
myserver.com:22:/var/log/syslog.1:/var/log/syslog.2
```

--------------------------------

### Nerdlog Logstream Specification

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_05_after_restart.txt

Explains how to specify logstreams, which are comma-separated strings identifying log sources. The format includes optional user, hostname, port, and log file path.

```text
Logstreams. Comma-separated strings in the format "[user@]myserver.com[:port[:/path/to/logfile]]"
Examples: "user@myserver.com", or "user@myserver.com:22:/var/log/syslog"
testhost-01
```

--------------------------------

### Apache PHP Error Log Entry

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/04_apache/want_log_resp_01_initial.txt

An example of an Apache log entry indicating a PHP Fatal error. This highlights errors originating from the PHP interpreter within the web server.

```text
2025-06-03T13:48:45.543210000Z,F,/tmp/nerdlog_core_test_output/04_apache/lstreams/testhost-3/logfile,000004,000004,erro,[php:error] [pid 1278] [client 192.168.1.101:49802] PHP Fatal error:  Uncaught Error: Call to undefined function mysql_connect() in /var/www/html/index.php:12
```

--------------------------------

### Nerdlog Awk Pattern Filtering

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_05_after_restart.txt

Details the use of awk patterns for filtering log entries. Supports regular expressions and logical operators like AND, OR, and NOT.

```text
awk pattern. Examples: "/foo bar/", or "( /foo bar/ || /other stuff/ ) && !/baz/"
/warn/
```

--------------------------------

### Nerdlog Logstream Identification

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/03_cli_flag_set_numlines/want_screen_01_initial.txt

Specifies the format for identifying log streams. Logstreams are comma-separated strings representing servers and log file paths. Examples include 'user@myserver.com' or 'user@myserver.com:22:/var/log/syslog'.

```Nerdlog Query Syntax
Logstreams. Comma-separated strings in the format "[user@]myserver.com[:port[:/path/to/logfile]]"
Examples: "user@myserver.com", or "user@myserver.com:22:/var/log/syslog"
localhost
```

--------------------------------

### Filtering Logs with Bash

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/01_simple/want_log_resp_03_load_more.txt

Demonstrates using the 'tail' command in bash to filter log entries starting from a specific byte offset. This is useful for incremental log processing or resuming from a previous point.

```bash
debug: bash -c 'tail -c +49400 /tmp/nerdlog_core_test_output/01_simple/lstreams/testhost-1/logfile'
```

--------------------------------

### Nerdlog custom transport command with SSH

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/options.md

Provides an example of a custom transport command for Nerdlog that replicates the functionality of the 'ssh-bin' transport. It utilizes Nerdlog-specific variables like NLHOST, NLPORT, and NLUSER, along with standard shell variable expansions, to construct the SSH command.

```shell
custom:ssh -o 'BatchMode=yes' ${NLPORT:+-p ${NLPORT}} ${NLUSER:+${NLUSER}@}${NLHOST} /bin/sh
```

--------------------------------

### Nerdlog Time Range Syntax

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_05_after_restart.txt

Defines the format for specifying time ranges in queries. Supports absolute times (e.g., 'Mar27 12:00') and relative times (e.g., '-2h30m'). The 'to' part is optional, defaulting to the current time.

```text
Time range in the format "<time>[ to <time>]", where <time> is either absolute like "Mar27 12:00"
or relative like "-2h30m" (relative to current time). If the "to" part is omitted,
current time is used.
Mar9 15:00 to Mar12 11:00
```

--------------------------------

### Get Logs from Offset (Bash)

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/02_two_logstreams/want_log_resp_02_load_more.txt

Retrieves log entries from a specified byte offset to the end of a log file. This command is useful for continuing log analysis from a precise point. It takes the log file path as input.

```bash
bash -c 'tail -c +25562 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile'
```

--------------------------------

### Bash Command for Log Filtering

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/01_simple/want_log_resp_02_load_more.txt

This snippet shows a bash command used to filter logs from a specific file, starting from a given byte offset. It's used to retrieve logs within a certain time range.

```bash
bash -c 'tail -c +49400 /tmp/nerdlog_core_test_output/01_simple/lstreams/testhost-1/logfile'
```

--------------------------------

### Filter Logs by Time Range (Bash)

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/50_journalctl_simple/want_log_resp_01_initial.txt

This command filters journalctl logs by a specified time range using the --since flag. It outputs logs in short-iso-precise format, quietly, and in reverse order. The example provided is used for debugging and testing log filtering capabilities.

```bash
debug: /tmp/nerdlog_core_test_output/50_journalctl_simple/lstreams/testhost-50/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-12 10:00:00"
```

--------------------------------

### Filter Logs by Time Range using journalctl

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/50_journalctl_simple/want_log_resp_03_load_more.txt

This command demonstrates how to filter system logs using `journalctl`. It specifies an output format, quiet mode, reverse chronological order, and defines the start and end times for the log entries to be retrieved. It also indicates that some lines might be skipped.

```bash
journalctl --output=short-iso-precise --quiet --reverse --since "2025-03-12 10:00:00" --until "2025-03-12 10:10:06"
```

--------------------------------

### Filter Logs by Time Range

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/50_journalctl_simple/want_log_resp_04_load_more.txt

This command demonstrates how to filter journalctl logs within a specified time range. It uses `--since` and `--until` flags to define the start and end times for the log retrieval. The output format is set to 'short-iso-precise' for clarity, and '--quiet' suppresses any extra output.

```bash
/tmp/nerdlog_core_test_output/50_journalctl_simple/lstreams/testhost-50/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-12 10:00:00" --until "2025-03-12 10:01:03"
```

--------------------------------

### Override Log Transport Mechanism

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Allows customization of the transport mechanism for a specific logstream, overriding the global transport setting. This example shows how to configure a custom SSH transport for log retrieval.

```yaml
log_streams:
  myhost-01:
    # ... Potentially any other configuration for the logstream
    options:
      transport: 'custom:ssh -o BatchMode=yes ${NLPORT:+-p ${NLPORT}} ${NLUSER:+${NLUSER}@}${NLHOST} /bin/sh'
```

--------------------------------

### Filter Logs by Time Range (Bash)

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/52_journalctl_with_pattern/want_log_resp_01_initial.txt

This bash command demonstrates how to filter journalctl logs within a specific time range. It uses the '--since' flag to specify the start time and '--output' for formatted output. It also shows the number of lines filtered out.

```bash
debug:Command to filter logs by time range:
debug: /tmp/nerdlog_core_test_output/52_journalctl_with_pattern/lstreams/testhost-52/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-11 19:00:00"
debug:Filtered out 211 from 236 lines
```

--------------------------------

### Awk Pattern for Time-Based Log Analysis

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_14_show_original.txt

This `awk` pattern is designed to analyze log entries and extract time information, likely for calculating durations between events. The example shows a pattern that identifies a time range from Mar9 15:00 to Mar12 11:00, resulting in a duration of 68 hours.

```awk
awk pattern:                                                     Mar9 15:00 to Mar12 11:00 (68h)
```

--------------------------------

### Filter Logs by Time Range (Bash)

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/51_journalctl_dupes_no_pattern/want_log_resp_01_initial.txt

This bash command demonstrates how to filter journalctl logs. It specifies an output format, quiet mode, reverse order, and defines both a start ('since') and end ('until') time for the log entries. It's used here to extract logs within a specific 2.5-hour window.

```bash
debug: /tmp/nerdlog_core_test_output/51_journalctl_dupes_no_pattern/lstreams/testhost-51/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-10 10:00:00" --until "2025-03-10 12:30:00"
```

--------------------------------

### Filter Logs by Time Range (Bash)

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/51_journalctl_dupes_no_pattern/want_log_resp_04_load_more.txt

This bash command filters journalctl logs within a specified time range. It uses options to control output format, quietness, reverse order, and define the start and end times for the logs. It's useful for isolating specific log events.

```bash
/tmp/nerdlog_core_test_output/51_journalctl_dupes_no_pattern/lstreams/testhost-51/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-10 10:00:00" --until "2025-03-10 11:49:52"
```

--------------------------------

### Setting and Checking Nerdlog Options

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/options.md

Demonstrates how to interact with Nerdlog's options using the ':set' command for checking current values and assigning new ones. It also shows how to provide initial option values using the '--set' flag during startup.

```shell
$ nerdlog --set 'numlines=1000' --set 'transport=ssh-bin'
```

```shell
:set numlines?
```

```shell
:set numlines=1000
```

--------------------------------

### Version and About Information

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Displays version information or about details for Nerdlog.

```shell
:version
```

```shell
:about
```

--------------------------------

### Run All Nerdlog Tests

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/tests.md

Executes all tests within the Nerdlog project using the make command.

```shell
make test
```

--------------------------------

### Field Selection and Aliasing in Nerdlog

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_01_initial.txt

Illustrates how to select and alias fields for output in Nerdlog queries. You can specify fields by name, use wildcards, and assign aliases using the 'AS' keyword.

```sql
time STICKY, message, lstream, level_name AS level, *
```

```sql
time STICKY, message, lstream, *
```

--------------------------------

### Copy Query Command to Clipboard

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Copies a command string to the clipboard that replicates the current logstream filter, time range, and query. This string can be used to open Nerdlog in a new instance or to apply the query in a running instance.

```shell
nerdlog --lstreams 'localhost' --time -3h --pattern '/something/'
```

--------------------------------

### View Log File with SSH and Vim

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_14_show_original.txt

This command uses SSH to connect to a remote host and `vim` to open a log file. It sets the file type to 'messages' and navigates to a specific line using `tail` and `head` to display the relevant log entries.

```shell
ssh -t testhost-01 'vim +"set ft=messages" +686 <(tail -n +1 /tmp/nerdlog_e2e_test_output/01_basic/lshells/testhost-01/logfile | head -n 1685)'
```

--------------------------------

### Nerdlog Navigation Keyboard Shortcuts

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Lists keyboard shortcuts for navigating the Nerdlog application, including browser-like shortcuts for history and refresh, and Vim-like bindings for cursor movement and mode switching.

```Browser-like Shortcuts
`Alt+Left`: Go back in history
`Alt+Right`: Go forward in history
`F5` or `Ctrl+R`: Refresh (rerun the same query)
`Shift+F5` or `Alt+Ctrl+R`: Hard refresh (rebuild index)
```

```Vim-like Shortcuts
Movement: `h`, `j`, `k`, `l`, `g`, `G`, `Ctrl+U`, `Ctrl+D`
Normal mode: `Escape`
Enter command mode: `:`
Enter query input: `i` or `a`
```

```Input History
Command line/query input history: `Up` / `Down` or `Ctrl+P` / `Ctrl+N`
Full query history (in edit form): `Ctrl+K` / `Ctrl+J`
```

--------------------------------

### Logstream Equivalence with Custom Config

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Illustrates the resulting logstream specification when using the simplified Nerdlog configuration combined with SSH config defaults, showing the merged details.

```text
myuser@actualhost1.com:1234:/some/custom/logfile:/some/custom/logfile.1
```

--------------------------------

### Debug Output Parsing

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/02_two_logstreams/want_log_resp_01_initial.txt

Demonstrates the structure of debug information collected for different hosts, detailing agent standard output and standard error. This information is vital for troubleshooting and understanding agent behavior.

```json
{
  "testhost-2": {
    "AgentStdout": null,
    "AgentStderr": [
      "debug:index file doesn't exist or is empty, gonna refresh it",
      "debug:the from 2025-03-12-09:00 is found: 1022 (67792)",
      "debug:Getting logs from offset 48636 until the end of latest /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-2/logfile.",
      "debug:Command to filter logs by time range:",
      "debug: bash -c 'tail -c +48636 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-2/logfile'",
      "debug:Filtered out 0 from 32 lines"
    ]
  },
  "testhost-dense": {
    "AgentStdout": null,
    "AgentStderr": [
      "debug:prev logfile /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile.1 doesn't exist, using a dummy empty file /tmp/nerdlog-empty-file",
      "debug:index file doesn't exist or is empty, gonna refresh it",
      "debug:the from 2025-03-12-09:00 is found: 388 (25562)",
      "debug:Getting logs from offset 25562 until the end of latest /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile.",
      "debug:Command to filter logs by time range:",
      "debug: bash -c 'tail -c +25562 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile'",
      "debug:Filtered out 0 from 16 lines"
    ]
  }
}
```

--------------------------------

### Navigate Queries

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Allows navigation to previous or next queries, similar to browser history. These actions can also be triggered via menu options or keyboard shortcuts.

```shell
:back
```

```shell
:prev
```

```shell
:fwd
```

```shell
:next
```

--------------------------------

### Nerdlog Query Field Selection

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Demonstrates the syntax for selecting and presenting log fields in the nerdlog UI, including sticky columns and aliasing.

```nerdlog
time STICKY, lstream, message, *
message AS msg
```

--------------------------------

### Nerdlog Field Selection Expression

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/03_cli_flag_set_numlines/want_screen_01_initial.txt

Describes how to select and alias fields in log query results. Users can specify individual fields, use wildcards for all fields, and assign aliases using the 'AS' keyword.

```Nerdlog Query Syntax
Select field expression. Example: "time STICKY, message, lstream, level_name AS level, *"
time STICKY, message, lstream, *
```

--------------------------------

### Execute journalctl mock for testing

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/50_journalctl_simple/want_log_resp_02_load_more.txt

This snippet demonstrates the execution of a mock journalctl script for testing purposes. It utilizes specific command-line arguments to control the output format, quietness, reversal of logs, and time-based filtering. The script is designed to simulate journalctl behavior for testing log collection and processing.

```bash
debug: /tmp/nerdlog_core_test_output/50_journalctl_simple/lstreams/testhost-50/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-12 10:00:00" --until "2025-03-12 10:17:00"
```

--------------------------------

### Nerdlog Logstream Specification

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_06_previous_query.txt

Defines the logstreams to query in Nerdlog. Logstreams are comma-separated strings specifying server, port, and log file path.

```Nerdlog Query Language
user@myserver.com
```

```Nerdlog Query Language
user@myserver.com:22:/var/log/syslog
```

```Nerdlog Query Language
testhost-01
```

--------------------------------

### Manage Logstream Connections

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Commands to manage connections to logstreams, including reconnecting, disconnecting, and viewing connection debug information.

```shell
:reconnect
```

```shell
:disconnect
```

```shell
:conndebug
```

```shell
:cdebug
```

--------------------------------

### Log Entry Format

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/02_two_logstreams/want_log_resp_01_initial.txt

Represents the structured format of individual log entries, including timestamp, log level, file path, and message content. This format is crucial for parsing and analyzing log data.

```text
2025-03-12T10:56:29.000000000Z,F,/tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile,000399,000399,erro,<err> User account enabled
  context: {"hostname":"myhost","lstream":"testhost-dense","pid":"8322","program":"authpriv"}
  orig: Mar 12 10:56:29 myhost authpriv[8322]: <err> User account enabled
```

--------------------------------

### Quit Application

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Exits the Nerdlog application.

```shell
:quit
```

```shell
:q
```

--------------------------------

### SSH Config Glob Support

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Demonstrates how glob patterns (e.g., `myhost-*`) can be used with SSH config aliases to connect to multiple hosts that match the pattern.

```text
myuser@actualhost1.com:1234,myuser@actualhost2.com:7890
```

--------------------------------

### Extracting Logs with tail Command

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/02_two_logstreams/want_log_resp_04_load_more.txt

Demonstrates how to extract log entries from a specified offset to the end of a log file using the `tail` command. This is useful for incremental log processing or retrieving recent logs.

```bash
debug: bash -c 'tail -c +48636 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-2/logfile'
```

```bash
debug: bash -c 'tail -c +25562 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile'
```

--------------------------------

### Logstream Format for Nerdlog

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_01_initial.txt

Details the format for specifying logstreams, which are comma-separated strings representing log sources. The format can include username, hostname, port, and file path.

```text
user@myserver.com
```

```text
user@myserver.com:22:/var/log/syslog
```

```text
localhost
```

--------------------------------

### Query Debugging

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Displays debug information for the last query executed. Aliases are available for convenience.

```shell
:querydebug
```

```shell
:qdebug
```

```shell
:debug
```

--------------------------------

### Refresh Query and Connections

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Reruns the current query. A hard refresh also rebuilds the index for every logstream. These actions are available via menu and keyboard shortcuts.

```shell
:refresh
```

```shell
:refresh!
```

--------------------------------

### Nerdlog Awk Pattern Filtering

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/03_cli_flag_set_numlines/want_screen_01_initial.txt

Details the syntax for using awk patterns to filter log entries. This allows for complex filtering logic using regular expressions, boolean operators (AND, OR, NOT), and grouping with parentheses.

```Nerdlog Query Syntax
awk pattern. Examples: "/foo bar/", or "( /foo bar/ || /other stuff/ ) && !/baz/"
```

--------------------------------

### Use External SSH Binary in Nerdlog

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/troubleshooting.md

This command demonstrates how to configure Nerdlog to use an external SSH binary instead of its internal implementation. This can resolve connection issues caused by complex SSH configurations not being fully parsed by Nerdlog's internal SSH client. The `--set 'transport=ssh-bin'` flag activates this functionality.

```bash
nerdlog --set 'transport=ssh-bin'
```

--------------------------------

### Time Range Specification in Nerdlog

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_01_initial.txt

Explains the format for specifying time ranges in Nerdlog queries. Time can be absolute (e.g., 'Mar27 12:00') or relative to the current time (e.g., '-2h30m').

```text
-1h
```

```text
Mar27 12:00 to Mar27 14:30
```

```text
-2h30m
```

--------------------------------

### Run Core Tests with Custom Hostname

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/tests.md

Executes the core Nerdlog tests while specifying a custom hostname, enabling testing of SSH transport. This requires a local SSH server and passwordless SSH agent access.

```shell
NERDLOG_CORE_TEST_HOSTNAME='127.0.0.1' make test ARGS='-run TestCoreScenarios'
```

--------------------------------

### Simplified Nerdlog Config with SSH Defaults

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Shows a simplified Nerdlog configuration file where only custom log files are specified, relying on SSH config for hostname, user, and port details. This assumes the SSH config is already set up.

```yaml
log_streams:
  myhost-01:
    log_files:
        * /some/custom/logfile
  myhost-02:
    log_files:
        * /some/custom/logfile
```

--------------------------------

### System Core Dump with Stack Trace

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/input_journalctl/small_mar/journalctl_data_small_mar.txt

This snippet captures log entries indicating a process has dumped core, including detailed information about the modules involved and the stack trace. This is crucial for debugging application crashes.

```text
2025-03-11T00:54:23.658592+00:00 myhost syslog[5082]: <error> Process 123456 (SomethingSomething) of user 1000 dumped core.
                                                      
                                                      Module /usr/lib/foo.so.1
                                                      Module /usr/lib/bar.so.1
                                                      Module /usr/lib/baz.so.1
                                                      Stack trace of thread 1:
                                                      #0  0x0000999c4f628a50 n/a (/usr/lib/foo.so.6 + 0x8028a50)
                                                      #1  0x0000580700fe1354 n/a (n/a + 0x0)
                                                      #2  0x00007ffd0fa86b3f n/a (n/a + 0x0)
                                                      #3  0x656269765f746e75 n/a (n/a + 0x0)
                                                      ELF object binary architecture: AMD x86-64
```

```text
2025-03-11T01:13:33.183549+00:00 myhost auth[693]: <error> Process 1234 (FooBar) of user 1000 dumped core.
                                                   
                                                   Module /usr/lib/foo.so.1
                                                   Module /usr/lib/bar.so.1
                                                   Module /usr/lib/baz.so.1
                                                   Stack trace of thread 1:
                                                   #0  0x0000999c4f628a50 n/a (/usr/lib/foo.so.6 + 0x8028a50)
                                                   #1  0x0000580700fe1354 n/a (n/a + 0x0)
                                                   #2  0x00007ffd0fa86b3f n/a (n/a + 0x0)
                                                   #3  0x656269765f746e75 n/a (n/a + 0x0)
                                                   ELF object binary architecture: AMD x86-64
```

--------------------------------

### Nerdlog Field Selection Expression

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_06_previous_query.txt

Specifies which fields to select and how to display them in Nerdlog query results. Supports aliasing fields.

```Nerdlog Query Language
time STICKY, message, lstream, level_name AS level, *
```

```Nerdlog Query Language
time STICKY, lstream, message, *
```

--------------------------------

### Execute Shell Commands with shell_init

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Configures arbitrary shell commands to run during logstream initialization. This is useful for setting environment variables, such as timezone or custom variables, before logs are processed. The `shell_init` option accepts an array of shell commands.

```yaml
log_streams:
  myhost-01:
    # ... Potentially any other configuration for the logstream
    options:
      shell_init:
        - 'export TZ=UTC'
        - 'export FOO=bar'
        - 'some other command'
```

--------------------------------

### Filter Logs by Time Range with journalctl

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/51_journalctl_dupes_no_pattern/want_log_resp_08_load_more.txt

This command demonstrates how to filter system logs using journalctl, specifying a time range with --since and --until flags. It also includes options for output format and quiet operation.

```bash
/tmp/nerdlog_core_test_output/51_journalctl_dupes_no_pattern/lstreams/testhost-51/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-10 10:00:00" --until "2025-03-10 11:49:45"
```

--------------------------------

### Direct Logstream Specification

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Demonstrates the explicit syntax for defining a logstream, including SSH connection details and log file paths. This format can be used directly in query forms.

```text
myuser@myhost.com:22:/var/log/syslog:/var/log/syslog.1
```

--------------------------------

### Write Log Lines to File

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Writes all currently loaded log lines to a specified filename. If no filename is provided, it defaults to `/tmp/last_nerdlog`.

```shell
:write [filename]
```

```shell
:w [filename]
```

--------------------------------

### Nerdlog Awk Pattern Filtering

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_06_previous_query.txt

Applies awk patterns for filtering log entries in Nerdlog. Supports regular expressions and logical operators.

```Nerdlog Query Language
/error/
```

```Nerdlog Query Language
/foo bar/
```

```Nerdlog Query Language
( /foo bar/ || /other stuff/ ) && !/baz/
```

--------------------------------

### Extracting Logs with Tail Command

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/02_two_logstreams/want_log_resp_03_load_more.txt

This snippet demonstrates how to extract log data from a specified offset within a log file using the 'tail' command in bash. It's used to retrieve logs from a particular point in time or a specific range.

```bash
tail -c +48636 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-2/logfile
```

```bash
tail -c +25562 /tmp/nerdlog_core_test_output/02_two_logstreams/lstreams/testhost-dense/logfile
```

--------------------------------

### Run Tests Skipping Agent Indexing

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/tests.md

Runs all Nerdlog tests but skips the slowest agent tests that involve index updates. This is useful for faster test cycles when index behavior is not the primary focus.

```shell
NERDLOG_AGENT_TEST_SKIP_INDEX_UP=1 make test
```

--------------------------------

### Filter Logs by Time Range Command

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/52_journalctl_with_pattern/want_log_resp_02_load_more.txt

This command demonstrates how to filter journalctl logs by a specific time range using the --since and --until flags. It also specifies the output format and enables quiet mode.

```shell
/tmp/nerdlog_core_test_output/52_journalctl_with_pattern/lstreams/testhost-52/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-11 19:00:00" --until "2025-03-12 06:43:45"
```

--------------------------------

### SSH Config Host Alias Usage

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Shows how an SSH config alias (`myhost-01`) translates to a full connection string, utilizing the details defined in the `~/.ssh/config` file.

```text
myuser@actualhost1.com:1234
```

--------------------------------

### Filter Logs by Time Range using journalctl

Source: https://github.com/dimonomid/nerdlog/blob/master/core/core_testdata/test_cases_core/51_journalctl_dupes_no_pattern/want_log_resp_07_load_more.txt

This command demonstrates how to filter journalctl logs by a specific time range using the --since and --until flags. It outputs logs in a short ISO precise format and skips duplicates.

```bash
debug:Command to filter logs by time range:
/tmp/nerdlog_core_test_output/51_journalctl_dupes_no_pattern/lstreams/testhost-51/journalctl_mock/journalctl_mock.sh --output=short-iso-precise --quiet --reverse --since "2025-03-10 10:00:00" --until "2025-03-10 11:49:45"
```

--------------------------------

### Nerdlog Logstream Specification (SSH)

Source: https://github.com/dimonomid/nerdlog/blob/master/README.md

Specifies how to define logstreams for remote servers via SSH. Supports custom ports and log file paths, including explicit 'journalctl' selection.

```nerdlog
myuser@myserver.com
```

```nerdlog
myuser@myserver.com:1234:/some/other/logfile
```

```nerdlog
myuser@myserver.com:1234:journalctl
```

```nerdlog
myuser@myserver.com, myuser@myserver.com:1234:/some/other/logfile
```

--------------------------------

### Nerdlog Time Range Query

Source: https://github.com/dimonomid/nerdlog/blob/master/cmd/nerdlog/e2e_testdata/test_scenarios/01_basic/want_screen_06_previous_query.txt

Specifies the time range for log queries in Nerdlog. Supports absolute and relative time formats. If 'to' is omitted, the current time is used.

```Nerdlog Query Language
Mar9 15:00 to Mar12 11:00
```

--------------------------------

### Agent Script Logic - Log Filtering with Awk

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/how_it_works.md

Illustrates how the agent script filters log lines using `tail`, `head`, and `awk`. It first cuts log parts outside the time range and then applies an `awk` pattern to the remaining lines. The `awk` script skips lines that do not match the provided pattern.

```awk
# Example awk logic for filtering logs:
# !( /your_pattern/ ) { next }
```

--------------------------------

### Update Test Expectations with Make

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/tests.md

This command updates the expected outputs for all tests by running them and copying the actual outputs to the repository. It's crucial for synchronizing actual and expected results after format changes. It also sets an environment variable to specifically generate stderr after the first iteration for agent tests.

```bash
make update-test-expectations
```

--------------------------------

### Journalctl Logstream Specification

Source: https://github.com/dimonomid/nerdlog/blob/master/docs/core_concepts.md

Shows how to explicitly select `journalctl` as the source for a logstream by specifying 'journalctl' as the file. This is an alternative to file-based logstreams.

```text
myuser@myhost.com:22:journalctl
```