more search enhancements (#22)

cmd/search.go

@@ -36,12 +36,23 @@ func Search(conf *cfg.Config) *cli.Command {
 <sep> might be one of:
  =: Must match
 !=: Must not match
- ?: Should match
 
 You can omit a field spec and thereby search across all fields.
 
+By default all queries contribute to matches (logical AND), use
+-O to apply a logical OR operator.
+
 You can also search multiple fields by separating them with comma, eg:
-user,group=root`,
+user,group=root
+
+Use filters to further restrict results, they must match literally.
+
+For datetime range format refer to:
+https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+
+For timestamp formats refer to:
+https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format
+`,
 
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -53,17 +64,17 @@ user,group=root`,
 			},
 			&cli.IntFlag{
 				Name:        "from",
-				Usage:       "show results FROM (default 0)",
+				Usage:       "show results starting at <from>",
 				Destination: &conf.From,
 				Value:       0,
 				Aliases:     []string{"f"},
 			},
 			&cli.IntFlag{
-				Name:        "to",
-				Usage:       "show results to (default 10)",
+				Name:        "len",
+				Usage:       "number of results to show (-1: all[max:10k], caution: might be slow)",
 				Destination: &conf.To,
-				Value:       10,
-				Aliases:     []string{"t"},
+				Value:       20,
+				Aliases:     []string{"l"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
@@ -77,12 +88,36 @@ user,group=root`,
 				Destination: &conf.Path,
 				Aliases:     []string{"p"},
 			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
 			&cli.BoolFlag{
 				Name:        "help-jsonpath",
 				Usage:       "show jsonPath help",
 				Destination: &conf.Subhelp,
 				Aliases:     []string{"H"},
 			},
+			&cli.BoolFlag{
+				Name:        "tail",
+				Usage:       "follow search live, like tail -f",
+				Destination: &conf.Tail,
+				Aliases:     []string{"T"},
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -92,6 +127,10 @@ user,group=root`,
 
 			args := cmd.Args()
 
+			if conf.To == -1 {
+				conf.To = 10000
+			}
+
 			return es.Search(conf, args.Slice())
 		},
 	}