more search enhancements (#22)

cmd/root.go

@@ -22,6 +22,7 @@ import (
 	"os"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
 
 	"github.com/urfave/cli/v3"
@@ -54,6 +55,12 @@ func Main() int {
 				Sources:     cli.EnvVars("ES_DEBUG"),
 				Destination: &conf.Debug,
 			},
+			&cli.BoolFlag{
+				Name:        "debug-http",
+				Value:       false,
+				Usage:       "enable HTTP debugging",
+				Destination: &conf.DebugHTTP,
+			},
 			&cli.StringFlag{
 				Name:        "config",
 				Aliases:     []string{"c"},
@@ -89,6 +96,7 @@ func Main() int {
 			Doc(conf),
 			Repl(conf),
 			Version(conf),
+			Debug(conf),
 		},
 
 		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
@@ -122,3 +130,24 @@ func Version(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func Debug(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "debug",
+		Usage: "developer only",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to search within",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.Debug(conf)
+		},
+	}
+}

cmd/search.go

@@ -36,12 +36,23 @@ func Search(conf *cfg.Config) *cli.Command {
 <sep> might be one of:
  =: Must match
 !=: Must not match
- ?: Should match
 
 You can omit a field spec and thereby search across all fields.
 
+By default all queries contribute to matches (logical AND), use
+-O to apply a logical OR operator.
+
 You can also search multiple fields by separating them with comma, eg:
-user,group=root`,
+user,group=root
+
+Use filters to further restrict results, they must match literally.
+
+For datetime range format refer to:
+https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+
+For timestamp formats refer to:
+https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format
+`,
 
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -53,17 +64,17 @@ user,group=root`,
 			},
 			&cli.IntFlag{
 				Name:        "from",
-				Usage:       "show results FROM (default 0)",
+				Usage:       "show results starting at <from>",
 				Destination: &conf.From,
 				Value:       0,
 				Aliases:     []string{"f"},
 			},
 			&cli.IntFlag{
-				Name:        "to",
-				Usage:       "show results to (default 10)",
+				Name:        "len",
+				Usage:       "number of results to show (-1: all[max:10k], caution: might be slow)",
 				Destination: &conf.To,
-				Value:       10,
-				Aliases:     []string{"t"},
+				Value:       20,
+				Aliases:     []string{"l"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
@@ -77,12 +88,36 @@ user,group=root`,
 				Destination: &conf.Path,
 				Aliases:     []string{"p"},
 			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
 			&cli.BoolFlag{
 				Name:        "help-jsonpath",
 				Usage:       "show jsonPath help",
 				Destination: &conf.Subhelp,
 				Aliases:     []string{"H"},
 			},
+			&cli.BoolFlag{
+				Name:        "tail",
+				Usage:       "follow search live, like tail -f",
+				Destination: &conf.Tail,
+				Aliases:     []string{"T"},
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -92,6 +127,10 @@ user,group=root`,
 
 			args := cmd.Args()
 
+			if conf.To == -1 {
+				conf.To = 10000
+			}
+
 			return es.Search(conf, args.Slice())
 		},
 	}