diff options
Diffstat (limited to '')
| -rw-r--r-- | src/help.md | 50 |
1 files changed, 38 insertions, 12 deletions
diff --git a/src/help.md b/src/help.md index 8a8e8fa..9dafca2 100644 --- a/src/help.md +++ b/src/help.md @@ -49,19 +49,14 @@ not have to manually specify the log file format. The currently supported formats are: syslog, apache, strace, tcsh history, and generic log files with timestamps. -Lnav will also display data piped in on the standard input. The -following options are available when doing so: - -* `-t` Prepend timestamps to the lines of data being read in - on the standard input. -* `-w file` Write the contents of the standard input to this file. +Lnav will also display data piped in on the standard input. To automatically execute queries or lnav commands after the files have been loaded, you can use the following options: * `-c cmd` A command, query, or file to execute. The first character determines the type of operation: a colon (`:`) is used for the - built-in commands; a semi-colon (`;`) for SQL queries; and a + built-in commands; a semi-colon (`;`) for SQL/PRQL queries; and a pipe symbol (`|`) for executing a file containing other commands. For example, to open the file "foo.log" and go to the tenth line in the file, you can do: @@ -224,7 +219,7 @@ that you can always use `q` to pop the top view off of the stack. | o/O | Move forward/backward to the log message with a matching 'operation ID' (opid) field. | | u/U | Move forward/backward through any user bookmarks you have added using the 'm' key. This hotkey will also jump to the start of any log partitions that have been created with the 'partition-name' command. | | s/S | Move to the next/previous "slow down" in the log message rate. A slow down is detected by measuring how quickly the message rate has changed over the previous several messages. For example, if one message is logged every second for five seconds and then the last message arrives five seconds later, the last message will be highlighted as a slow down. | -| {/} | Move to the previous/next location in history. Whenever you jump to a new location in the view, the location will be added to the history. The history is not updated when using only the arrow keys. | +| {/} | Move to the previous/next section in the view. In the LOG view, this moves through partitions. In other views, it moves through sections of documents. | ### Chronological Navigation @@ -318,14 +313,14 @@ If you are using Xterm, or a compatible terminal, you can use the mouse to mark lines of text and move the view by grabbing the scrollbar. NOTE: You need to manually enable this feature by setting the LNAV_EXP -environment variable to "mouse". F2 toggles mouse support. +environment variable to "mouse". `F2` toggles mouse support. -## SQL Queries (experimental) +## Log Analysis Lnav has support for performing SQL queries on log files using the -Sqlite3 "virtual" table feature. For all supported log file types, +SQLite3 "virtual" table feature. For all supported log file types, lnav will create tables that can be queried using the subset of SQL -that is supported by Sqlite3. For example, to get the top ten URLs +that is supported by SQLite3. For example, to get the top ten URLs being accessed in any loaded Apache log files, you can execute: ```lnav @@ -420,6 +415,37 @@ example of a top ten query into the "/tmp/topten.db" file, you can do: LIMIT 10; ``` +### PRQL Support + +The Pipelined Relational Query Language +[(PRQL)](https://prql-lang.org) is an alternative database query +language that compiles to SQL. The main advantage of PRQL, +in the context of lnav, is that it is easier to work with +interactively compared to SQL. For example, lnav can provide +previews of different stages of the pipeline and provide more +accurate tab-completions for the columns in the result set. + +You can execute a PRQL query in the SQL prompt. A PRQL query +starts with the `from` keyword that specifies the table to use as +a data source. The next stage of a pipeline is started by entering +a pipe symbol (`|`) followed by a +[PRQL transform](https://prql-lang.org/book/reference/stdlib/transforms/index.html). +As you build the query in the prompt, lnav will display any relevant +help and preview for the current and previous stages of the pipeline. + +Using the top ten URLs query from earlier as an example, the PRQL +version would be as follows: + +```lnav +;from access_log | stats.count_by cs_uri_stem | take 10 +``` + +The first stage selects the data source, the web `access_log` table +in this case. The `stats.count_by` transform is a convenience +provided by lnav that groups by the given column, counts the rows +in each group, and sorts by count in descending order. The `take 10` +turns into the `LIMIT 10`. + ## Dynamic logline Table (experimental) (NOTE: This feature is still very new and not completely reliable yet, |