obsidianlog query - ObsidianLog

This retrieves archived logs matching a set of filters. Results are decrypted index-first: a lightweight metadata index (under 1% of log size) is scanned first, so full chunks are only fetched and decrypted when they actually match.

Flags

Flag	Description
`--from <TIME>`	Inclusive lower bound of the time range. RFC 3339, or relative to now (e.g. `24h`, `30m`, `7d`). Compared against each log’s own `timestamp` field, not when it was ingested.
`--to <TIME>`	Inclusive upper bound of the time range. Same format as `--from`.
`--service <NAME>`	Filter by service name.
`--level <LEVEL>`	Filter by log level (e.g. `info`, `warn`, `error`).
`--host <HOST>`	Filter by originating host.
`--keyword <TEXT>`	Free-text keyword to match within log lines.
`--format <FORMAT>`	Output format: `human` (default, colorized terminal output), `json` (pretty-printed structured array), or `raw` (one decrypted JSON object per line, for piping to `jq`).

Plus the global --config <FILE>. All filters compose, and matching is exact per field.

Examples

# Last 24 hours of errors from the api service, human-readable.
obsidianlog query --service api --level error --from 24h --format human

# A specific window, piped to jq.
obsidianlog query --from 2026-08-01T00:00:00Z --to 2026-08-02T00:00:00Z \
  --format raw | jq '.msg'

# Free-text search across everything archived so far.
obsidianlog query --keyword "connection refused"

Retrieve and save one day’s logs

query is the retrieval command; there is no separate archive-download command. To retrieve a service’s logs for one UTC day and save the decrypted records locally, use exact RFC 3339 bounds with --format raw:

obsidianlog query \
  --service payments-api \
  --from 2026-09-20T00:00:00Z \
  --to 2026-09-20T23:59:59Z \
  --format raw \
  > payments-api-2026-09-20.jsonl

The resulting .jsonl file contains one decrypted JSON log event per line. It is plaintext data: store, share, and delete it according to the same security policy you apply to the original logs. Add --level, --host, or --keyword to narrow the exported records further.