From cfa2968f352f4b7ca3e4fc70e7026c9da0da13e0 Mon Sep 17 00:00:00 2001 From: shiv Date: Thu, 22 Oct 2026 00:43:33 +0530 Subject: [PATCH] docs(logs): Elasticsearch help examples that work on keyword fields Nubi copies the logs query --help examples first. Both Elasticsearch examples used {"match":...}, which on a keyword-mapped field (log on dev account bda8ae12) compares the whole value and silently returns 0; Nubi then spent dozens of calls finding out why. The examples now use a case-insensitive wildcard, which works on keyword and text fields, and the help says to check a field's Type (list-labels --fields-only) first. Verified live: the old examples return 0 lines; the new counts example returns 265 series summing to the exact total (170,084). Co-Authored-By: Claude Opus 5.5 --- cmd/logs_query.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/cmd/logs_query.go b/cmd/logs_query.go index 0dc483f..54dd5db 100644 --- a/cmd/logs_query.go +++ b/cmd/logs_query.go @@ -69,16 +69,21 @@ incomplete. Elasticsearch counts past 10,000 only with "track_total_hits": true. Counts as series (Elasticsearch): zero or more nested terms aggregations, optionally ending in one date_histogram. Use real field names from -"nbctl logs list-labels --fields-only"; terms needs a keyword field.`, +"nbctl logs list-labels --fields-only"; terms needs a keyword field. + +Check a field's Type before searching it: match on a keyword field compares +the whole value, so {"match":{"log":"error"}} silently finds nothing there. +A case-insensitive wildcard works on keyword and text fields alike.`, Example: ` # Loki nbctl logs query --query '{namespace="api"} |= "error"' --start-time 2026-10-01T00:00:00Z # Elasticsearch, Query DSL (in-cluster Elasticsearch needs --index) - nbctl logs query --index 'logs-*' --query '{"query":{"match":{"level":"error"}}}' -o json > logs.json + nbctl logs query --index 'logs-*' -o json > logs.json \ + --query '{"query":{"wildcard":{"log":{"value":"*error*","case_insensitive":true}}}}' # Elasticsearch, error lines per pod per hour (counts come back as series) nbctl logs query -o json > counts.json --query '{"size":0,"track_total_hits":true, - "query":{"match":{"log":"error"}}, + "query":{"wildcard":{"log":{"value":"*error*","case_insensitive":true}}}, "aggs":{"pod":{"terms":{"field":"kubernetes.pod_name","size":500}, "aggs":{"hour":{"date_histogram":{"field":"@timestamp","fixed_interval":"1h"}}}}}}'`, RunE: func(cmd *cobra.Command, args []string) error {