Querying logs

Every querying command accepts the same filter flags and a query string (-q or positional). All commands return human-readable output by default and JSON with --json.

logs

Default query — last 20 by recency, newest last.

loguro logs                                          # last 20
loguro logs -l error                                 # errors only
loguro logs --from 24h -m payment --slow 200 -c '!env=staging'
loguro logs -q 'level:error @last-1h'
loguro 'level:error @last-1h'                        # positional shortcut
loguro prod 'level:error context.duration:>=500'     # with app shortcut

tail

Follow new logs as they arrive (poll-based).

loguro tail
loguro tail -l error
loguro tail 'level:critical|error'

count

Get a number — exact total of logs matching the filter.

loguro count
loguro count -q 'level:error @last-1h'

# CI alerts
ERRORS=$(loguro count -q 'level:error @last-1h' --json | jq '.count | tonumber')
[ "$ERRORS" -gt 100 ] && curl -X POST $SLACK_WEBHOOK -d "alert: $ERRORS errors"

get

Fetch a single log by ID with full context.

loguro get 01KQ0E1ZTAP7YWFBK1S2K6XM2W
loguro get 01KQ0E1ZTAP7YWFBK1S2K6XM2W --investigate     # show log + AI in sequence

distinct

List unique values for a field across the matched set.

loguro distinct env
loguro distinct context.service

timeline

Logs around a specific log ID — useful for “what was happening when this error fired.”

loguro timeline 01KQ0E1ZTAP7YWFBK1S2K6XM2W --window 60

trace

All logs sharing a trace ID, in chronological order — debug a request end-to-end.

loguro trace 01KQ0E1ZTAP7YWFBK1S2K6XM2W
loguro trace 01KQ0E1ZTAP7YWFBK1S2K6XM2W --no-showContext
loguro prod trace 01KQ0...                          # app shortcut works

slow

Slow requests above a duration threshold (matches on context.duration).

loguro slow                                         # default 500ms
loguro slow --threshold 200                         # >200ms

sample

Random sample of logs — useful for spot-checking volume without scrolling.

loguro sample -n 20 -l error

group

Group logs by a field. Repeat -v to filter to specific values:

loguro group level -v error -v critical

Trim output to specific fields

--fields works on logs, tail, slow, and sample. Comma-separated list of dotted paths:

loguro logs --fields message,context.service,context.userId
loguro logs -l error --fields timestamp,message,context.path
loguro logs --fields message --json | jq '.items[]'

JSON output for piping

Every query command supports --json:

loguro logs -l error --json | jq '.items[].message'
loguro top message --json | jq '.values[].value'
loguro count --json | jq '.count'