Query syntax

The logs, tail, slow, and sample commands accept a query string with the same syntax as the Loguro UI, via -q or as a positional:

loguro logs -q 'level:error @last-1h'
loguro 'level:error @last-1h'                         # positional shortcut
loguro prod 'level:error context.duration:>=500'      # with app name
loguro tail 'level:critical|error'

Reference

Unrecognized tokens emit a warning suggesting how to quote them.

Context filters

-c key=value filters on context.<key>. Repeatable. Supports operators and negation:

-c user_id=42                # context.user_id = 42
-c duration>=500             # context.duration >= 500
-c '!env=staging'            # NOT context.env = staging

Operators: =, !=, >, <, >=, <=. Prefix ! to negate.

Time ranges

--from / --to accept ISO dates, relative shorthand, or natural language (via chrono-node):

--from 30m              # 30 minutes ago
--from 24h              # 24 hours ago
--from 7d               # 7 days ago
--from 2w               # 2 weeks ago
--from 2026-05-01       # ISO date
--from 2026-05-01T10:00:00Z

--from "3 days ago"     # natural language
--from "yesterday"
--from "last monday"
--from "2 hours ago"
--to "yesterday at 18:00"

Combinable:

loguro logs --from "3 days ago" --to "yesterday" -l error

If a time string can’t be parsed, the CLI prints a warning and passes it through to the API (which will return 400 with the offending value).