add role diff (#26)

Makefile

@@ -23,11 +23,24 @@ UID       = root
 GID       = 0
 HAVE_POD := $(shell pod2text -h 2>/dev/null)
 
+BRANCH          = $(shell git branch --show-current)
+COMMIT          = $(shell git rev-parse --short=8 HEAD)
+BUILD           = $(shell date +%Y.%m.%d.%H%M%S) 
+GOVERSION       = $(shell grep -E "^go" go.mod | cut -d' ' -f2)
+APIVERSION      = $(shell grep github.com/elastic/go-elasticsearch go.mod | cut -d' ' -f2)
+
+
 all: buildlocal
 
 
 buildlocal:
-	CGO_LDFLAGS='-static' go build -tags osusergo,netgo -ldflags "-extldflags=-static" -o $(tool)
+	CGO_LDFLAGS='-static' go build -tags osusergo,netgo -ldflags "-extldflags=-static" \
+     -ldflags "-X codeberg.org/scip/esctl/pkg/cfg.BRANCH=$(BRANCH) \
+               -X codeberg.org/scip/esctl/pkg/cfg.COMMIT=$(COMMIT) \
+			   -X codeberg.org/scip/esctl/pkg/cfg.GOVERSION=$(GOVERSION) \
+			   -X codeberg.org/scip/esctl/pkg/cfg.APIVERSION=$(APIVERSION) \
+			   -X codeberg.org/scip/esctl/pkg/cfg.BUILD=$(BUILD)" \
+     -o $(tool)
 	strip $(tool)
 
 install: buildlocal

README.md

@@ -6,7 +6,7 @@ Elasticsearch CLI
 
 ## Usage
 
-Command tree
+Command tree:
 
 ```console
  ccr
@@ -28,17 +28,22 @@ Command tree
          list
          set
      status
+ debug
  doc
      add
+     delete
+     show
  help
  index
      alias
          create
+         delete
          list
      allocation
      close
      create
      delete
+     fields
      list
      modify
      show
@@ -46,6 +51,9 @@ Command tree
      list
      show
  repl
+ role
+     list
+     show
  search
  shard
      list
@@ -53,6 +61,7 @@ Command tree
  snapshot
      list
      show
+ version
 ```
 
 Configure `esctl` with environment variables:

TODO.md

@@ -9,3 +9,25 @@
 
 - add shard explain, aka:
   get /_cluster/allocation/explain {"index":"yourindex", "primary": true, "shard":0}
+
+
+- add validate:
+
+> GET /mock/_validate/query?rewrite=true {"from":0,"query":{"bool":{"must":[{"match_all":{}}]}},"size":20,"sort":[{"name":{"order":"desc"}}]}
+{
+  "valid": false
+}
+
+- add explain to search (maybe option -e)
+
+> GET /mock/_explain/1780043878 {"query":{"bool":{"must":[{"match_all":{}}]}}}
+{
+  "_index": "mock",
+  "_id": "1780043878",
+  "matched": true,
+  "explanation": {
+    "value": 1.0,
+    "description": "*:*",
+    "details": []
+  }
+}

cmd/doc.go

@@ -33,7 +33,8 @@ func Doc(conf *cfg.Config) *cli.Command {
 
 		Commands: []*cli.Command{
 			DocAdd(conf),
-			//Delete(conf),
+			DocShow(conf),
+			DocDelete(conf),
 		},
 	}
 }
@@ -43,16 +44,134 @@ func DocAdd(conf *cfg.Config) *cli.Command {
 		Name:      "add",
 		Aliases:   []string{"+"},
 		Usage:     "add JSON document index",
-		UsageText: "add [options] <index> '<json-doc>'",
+		UsageText: "add [options] -i <index> '<json-doc>'",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 
-			if args.Len() != 2 {
-				return errors.New("missing arguments: <index> <json-doc>")
+			if args.Len() != 1 {
+				return errors.New("missing arguments: <json-doc>")
 			}
 
-			return es.DocAdd(conf, cmd.Args().Get(0), cmd.Args().Get(1))
+			return es.DocAdd(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func DocShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "show",
+		Aliases:   []string{"sh"},
+		Usage:     "show a JSON document",
+		UsageText: "show [options] -i <index> <id>",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+			&cli.StringFlag{
+				Name:        "path",
+				Usage:       "jsonPath filter (e.g. source.message)",
+				Destination: &conf.Path,
+				Aliases:     []string{"p"},
+			},
+			&cli.BoolFlag{
+				Name:        "help-jsonpath",
+				Usage:       "show jsonPath help",
+				Destination: &conf.Subhelp,
+				Aliases:     []string{"H"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
+			args := cmd.Args()
+
+			if args.Len() != 1 {
+				return errors.New("missing arguments: <id>")
+			}
+
+			return es.DocShow(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func DocDelete(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "delete",
+		Aliases:   []string{"rm"},
+		Usage:     "delete JSON document[s] from index[es]",
+		UsageText: "delete [options] -i <index> [<[field<sep>]pattern> ...]\n" + SearchUsage,
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "all",
+				Usage:       "delete all docs (dangerous!)",
+				Destination: &conf.All,
+				Aliases:     []string{"a"},
+			},
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+			&cli.StringSliceFlag{
+				Name:        "filter",
+				Usage:       "additional boolean filters. format: key=value",
+				Destination: &conf.Filter,
+				Aliases:     []string{"F"},
+			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
+			args := cmd.Args()
+
+			if args.Len() == 0 && !conf.All {
+				return errors.New("missing arguments: <query>")
+			}
+
+			return es.DocDelete(conf, cmd.Args().Slice())
 		},
 	}
 }

cmd/index.go

@@ -42,6 +42,7 @@ func Index(conf *cfg.Config) *cli.Command {
 			IndexAllocation(conf),
 			IndexModify(conf),
 			IndexAlias(conf),
+			IndexFields(conf),
 		},
 	}
 }
@@ -157,6 +158,8 @@ func IndexCreate(conf *cfg.Config) *cli.Command {
 		Name:    "create",
 		Aliases: []string{"+"},
 		Usage:   "create a new index",
+		UsageText: `create <name> <fieldmapping:type>...
+Valid field mapping types: integer, text, date, keyword`,
 
 		Flags: []cli.Flag{
 			&cli.BoolFlag{
@@ -250,3 +253,20 @@ func IndexModify(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func IndexFields(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "fields",
+		Usage:     "show info about field capabilities",
+		UsageText: "index fields <index>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.IndexFields(conf, index)
+		},
+	}
+}

cmd/index_alias.go

@@ -35,8 +35,8 @@ func IndexAlias(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			IndexAliasCreate(conf),
 			IndexAliasList(conf),
+			IndexAliasDelete(conf),
 			//IndexAliasShow(conf),
-			//IndexAliasDelete(conf),
 			//IndexAliasAdd(conf), // see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
 		},
 	}
@@ -62,6 +62,26 @@ func IndexAliasCreate(conf *cfg.Config) *cli.Command {
 	}
 }
 
+func IndexAliasDelete(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "delete",
+		Aliases:   []string{"rm"},
+		Usage:     "delete an index alias",
+		UsageText: "delete <index> <alias>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			alias := cmd.Args().Get(1)
+
+			if index == "" || alias == "" {
+				return errors.New("no index or alias specified")
+			}
+
+			return es.IndexAliasDelete(conf, index, alias)
+		},
+	}
+}
+
 func IndexAliasList(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:    "list",

cmd/roles.go

@@ -0,0 +1,137 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cmd
+
+import (
+	"context"
+	"errors"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
+
+	"github.com/urfave/cli/v3"
+)
+
+func Roles(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "role",
+		Usage: "manage roles",
+
+		Commands: []*cli.Command{
+			RoleList(conf),
+			RoleShow(conf),
+			RoleDiff(conf),
+		},
+	}
+}
+
+func RoleList(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:    "list",
+		Aliases: []string{"ls"},
+		Usage:   "list roles",
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "orphaned",
+				Usage:       "include only orphaned roles",
+				Destination: &conf.Failed,
+				Aliases:     []string{"o"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.RoleList(conf)
+		},
+	}
+}
+
+func RoleShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "show",
+		Aliases:   []string{"sh"},
+		Usage:     "show details about a role",
+		UsageText: "show [options] <role>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no role specified")
+			}
+
+			return es.RoleShow(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func RoleDiff(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "diff",
+		Usage: "show differences between roles and CSV baseline",
+		UsageText: `diff [options] <file.csv> [<role>]
+CSV format:
+index_name;role;index_privilege;cluster_privilege;ad_group;space;retention;kibana_privilege;field_privilege`,
+
+		MutuallyExclusiveFlags: []cli.MutuallyExclusiveFlags{{
+			Flags: [][]cli.Flag{
+				{
+					&cli.BoolFlag{
+						Name:        "not-deployed",
+						Usage:       "include only not deployed but defined roles",
+						Destination: &conf.NotDeployed,
+						Aliases:     []string{"n"},
+					},
+				},
+				{
+					&cli.BoolFlag{
+						Name:        "undefined",
+						Usage:       "include only deployed but undefined roles",
+						Destination: &conf.Undefined,
+						Aliases:     []string{"u"},
+					},
+				},
+				{
+					&cli.BoolFlag{
+						Name:        "diff",
+						Usage:       "include only differing roles",
+						Destination: &conf.Diff,
+						Aliases:     []string{"D"},
+					},
+				},
+			}},
+		},
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "separator",
+				Usage:       "CSV field separator",
+				Destination: &conf.Separator,
+				Aliases:     []string{"s"},
+				Value:       ",",
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			csvfile := cmd.Args().Get(0)
+			if csvfile == "" {
+				return errors.New("no CSV file specified")
+			}
+
+			return es.RoleDiff(conf, cmd.Args().Get(0), cmd.Args().Get(1))
+		},
+	}
+}

cmd/root.go

@@ -22,6 +22,7 @@ import (
 	"os"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
 
 	"github.com/urfave/cli/v3"
@@ -40,9 +41,9 @@ func Main() int {
 	conf := cfg.NewConfig()
 
 	cmd := &cli.Command{
-		Name:                  "esctl",
-		Usage:                 "manage elasticsearch from cli",
-		Version:               cfg.Version,
+		Name:  "esctl",
+		Usage: "manage elasticsearch from cli",
+		//Version:               cfg.Version,
 		EnableShellCompletion: true,
 
 		Flags: []cli.Flag{
@@ -54,6 +55,12 @@ func Main() int {
 				Sources:     cli.EnvVars("ES_DEBUG"),
 				Destination: &conf.Debug,
 			},
+			&cli.BoolFlag{
+				Name:        "debug-http",
+				Value:       false,
+				Usage:       "enable HTTP debugging",
+				Destination: &conf.DebugHTTP,
+			},
 			&cli.StringFlag{
 				Name:        "config",
 				Aliases:     []string{"c"},
@@ -69,6 +76,13 @@ func Main() int {
 				Usage:       "cluster alias to work with",
 				Destination: &conf.CurrentCluster,
 			},
+			&cli.StringFlag{
+				Name:        "output",
+				Aliases:     []string{"o"},
+				Value:       "",
+				Usage:       "output mode (tsv, markdown, json, yaml) default: tsv",
+				Destination: &conf.Output,
+			},
 		},
 
 		Commands: []*cli.Command{
@@ -81,6 +95,9 @@ func Main() int {
 			Node(conf),
 			Doc(conf),
 			Repl(conf),
+			Version(conf),
+			Debug(conf),
+			Roles(conf),
 		},
 
 		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
@@ -101,3 +118,37 @@ func Main() int {
 
 	return Finish(cmd.Run(context.Background(), os.Args))
 }
+
+func Version(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "version",
+		Usage: "show esctl version information",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			_, err := fmt.Printf("esctl version: %s\n  build: %s\n  branch: %s\n  commit: %s\n  go version: %s\n  API Version: %s\n",
+				cfg.Version, cfg.BUILD, cfg.BRANCH, cfg.COMMIT, cfg.GOVERSION, cfg.APIVERSION)
+			return err
+		},
+	}
+}
+
+func Debug(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "debug",
+		Usage: "developer only",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to search within",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.Debug(conf)
+		},
+	}
+}

cmd/search.go

@@ -18,7 +18,7 @@ package cmd
 
 import (
 	"context"
-	"errors"
+	"fmt"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -26,12 +26,33 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
+const SearchUsage = `<sep> might be one of:
+ =: Must match
+!=: Must not match
+
+You can omit a field spec and thereby search across all fields.
+
+By default all queries contribute to matches (logical AND), use
+-O to apply a logical OR operator.
+
+You can also search multiple fields by separating them with comma, eg:
+user,group=root
+
+Use filters to further restrict results, they must match literally.
+
+For datetime range format refer to:
+https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+
+For timestamp formats refer to:
+https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format
+`
+
 func Search(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "search",
 		Aliases:   []string{"/"},
 		Usage:     "search within an index",
-		UsageText: "search [options] <field=pattern> ...",
+		UsageText: "search [options] [<[field<sep>]pattern> ...]\n" + SearchUsage,
 
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -43,33 +64,118 @@ func Search(conf *cfg.Config) *cli.Command {
 			},
 			&cli.IntFlag{
 				Name:        "from",
-				Usage:       "show results FROM (default 0)",
+				Usage:       "show results starting at <from>",
 				Destination: &conf.From,
 				Value:       0,
 				Aliases:     []string{"f"},
 			},
 			&cli.IntFlag{
-				Name:        "to",
-				Usage:       "show results to (default 10)",
+				Name:        "len",
+				Usage:       "number of results to show (-1: all[max:10k], caution: might be slow)",
 				Destination: &conf.To,
-				Value:       10,
-				Aliases:     []string{"t"},
+				Value:       20,
+				Aliases:     []string{"l"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
-				Usage:       "additional filters. format: key=value",
+				Usage:       "additional boolean filters. format: key=value",
 				Destination: &conf.Filter,
 				Aliases:     []string{"F"},
 			},
+			&cli.StringFlag{
+				Name:        "jsonpath",
+				Usage:       "jsonPath filter (e.g. source.message)",
+				Destination: &conf.Path,
+				Aliases:     []string{"p"},
+			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
+			&cli.StringFlag{
+				Name:        "sort-by",
+				Usage:       "sort by a field",
+				Destination: &conf.SortBy,
+				Value:       "@timestamp",
+				Aliases:     []string{"k"},
+			},
+			&cli.BoolFlag{
+				Name:        "ascending",
+				Usage:       "sort in ascending order (default: descending)",
+				Destination: &conf.Ascending,
+				Aliases:     []string{"a"},
+			},
+			&cli.BoolFlag{
+				Name:        "help-jsonpath",
+				Usage:       "show jsonPath help",
+				Destination: &conf.Subhelp,
+				Aliases:     []string{"H"},
+			},
+			&cli.BoolFlag{
+				Name:        "tail",
+				Usage:       "follow search live, like tail -f",
+				Destination: &conf.Tail,
+				Aliases:     []string{"T"},
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
 			args := cmd.Args()
-			if args.Len() == 0 {
-				return errors.New("at least one query must be specified (format: field=pattern)")
+
+			if conf.To == -1 {
+				conf.To = 10000
 			}
 
 			return es.Search(conf, args.Slice())
 		},
 	}
 }
+
+func showJsonPathHelp() error {
+	_, err := fmt.Println(`jsonPath usage:
+
+name.last          >> "Anderson"
+age                >> 37
+children           >> ["Sara","Alex","Jack"]
+children.#         >> 3
+children.1         >> "Alex"
+child*.2           >> "Jack"
+c?ildren.0         >> "Sara"
+fav\.movie         >> "Deer Hunter"
+friends.#.first    >> ["Dale","Roger","Jane"]
+friends.1.last     >> "Craig"
+
+You can also  query an array for  the first match by  using #(...), or
+find all matches  with #(...)#. Queries support the ==,  !=, <, <=, >,
+>= comparison operators  and the simple pattern matching  % (like) and
+!% (not like) operators. Eg:
+
+friends.#(last=="Murphy").first    >> "Dale"
+friends.#(last=="Murphy")#.first   >> ["Dale","Jane"]
+friends.#(age>45)#.last            >> ["Craig","Murphy"]
+friends.#(first%"D*").last         >> "Murphy"
+friends.#(first!%"D*").last        >> "Craig"
+friends.#(nets.#(=="fb"))#.first   >> ["Dale","Roger"]
+
+Documentation: https://github.com/tidwall/gjson/blob/master/SYNTAX.md`)
+
+	return err
+}

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/mattn/go-isatty v0.0.22
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/tlinden/yadu v0.1.3
-	github.com/urfave/cli/v3 v3.9.0
+	github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -43,6 +43,9 @@ require (
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.8 // indirect
+	github.com/tidwall/gjson v1.19.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect

go.sum

@@ -58,12 +58,20 @@ github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
 github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
 github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
 github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tlinden/yadu v0.1.3 h1:5cRCUmj+l5yvlM2irtpFBIJwVV2DPEgYSaWvF19FtcY=
 github.com/tlinden/yadu v0.1.3/go.mod h1:l3bRmHKL9zGAR6pnBHY2HRPxBecf7L74BoBgOOpTcUA=
 github.com/urfave/cli/v3 v3.8.0 h1:XqKPrm0q4P0q5JpoclYoCAv0/MIvH/jZ2umzuf8pNTI=
 github.com/urfave/cli/v3 v3.8.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=
 github.com/urfave/cli/v3 v3.9.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de h1:ESKPiS7inVoBnv4FmgGNZdjWBI/wmvaragoyD3D9nM4=
+github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=

pkg/cfg/config.go

@@ -17,10 +17,13 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package cfg
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 
@@ -31,7 +34,12 @@ import (
 )
 
 const (
-	Version string = `v0.0.11`
+	Version string = `v0.0.16`
+)
+
+var (
+	// initialized during build, see Makefile:buildlocal
+	APIVERSION, GOVERSION, BUILD, COMMIT, BRANCH string
 )
 
 type Cluster struct {
@@ -43,6 +51,7 @@ type Config struct {
 	ConfigFile                     string // -c
 	CurrentCluster                 string // -C
 	Debug                          bool   // -d
+	Output                         string // -o <mode>
 	Clusters                       map[string]*Cluster
 	DefaultCluster                 *Cluster
 	Index                          string   // index: -i
@@ -52,11 +61,25 @@ type Config struct {
 	Primary                        bool     // index allocation: -p
 	From, To, MaxItems             int      // search: flags
 	Filter                         []string // search: -F
+	Path                           string   // search+doc sh: -p
+	Subhelp                        bool     // search+doc sh: -H
+	Tail                           bool     // search: -f [tail]
+	Or                             bool     // search: -O
+	Range                          string   // search: -r
+	TimestampFormat                string   // search: --timestamp-format
+	Explain                        bool     // search: -e
+	SortBy                         string   // sort: -k
+	Ascending                      bool     // sort: -a
 	Exclude                        string   // cluster compare: -e (regexp)
 	All, Verbose                   bool     // cluster status: -a -v
 	Persistent, Transient, Default bool     // -p -t -D cluster settings set
 	Force                          bool     // ccr follower renew: -f
 	HaveJQ                         bool     // determined at runtime by ourselfes
+	DebugHTTP                      bool     // root: --debug-http
+	Separator                      string   // role diff: -s
+	NotDeployed                    bool     // role diff: -n
+	Undefined                      bool     // role diff: -u
+	Diff                           bool     // role diff: -D
 }
 
 func NewConfig() *Config {
@@ -192,18 +215,26 @@ func (conf *Config) LoadConfig() error {
 	return nil
 }
 
+func (conf *Config) getTransport() elastictransport.Option {
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+
+	if conf.DebugHTTP {
+		return elastictransport.WithTransport(
+			&DebugTransport{Transport: transport},
+		)
+	}
+
+	return elastictransport.WithTransport(transport)
+}
+
 func (conf *Config) SetupES() error {
 	for _, cluster := range conf.Clusters {
 		es, err := elasticsearch.NewTyped(
 			elasticsearch.WithAddresses(cluster.Uri),
 			elasticsearch.WithBasicAuth(cluster.User, cluster.Pass),
-			elasticsearch.WithTransportOptions(
-				elastictransport.WithTransport(
-					&http.Transport{
-						TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-					},
-				),
-			),
+			elasticsearch.WithTransportOptions(conf.getTransport()),
 		)
 
 		if err != nil {
@@ -216,6 +247,39 @@ func (conf *Config) SetupES() error {
 	return nil
 }
 
+// used to print uri, path and body of a request made by the go-client
+type DebugTransport struct {
+	Transport http.RoundTripper
+}
+
+func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	content := ""
+	contentline := ""
+
+	if req.ContentLength > 0 {
+		buf := new(bytes.Buffer)
+		body, _ := req.GetBody()
+
+		_, err := buf.ReadFrom(body)
+		if err != nil {
+			return nil, err
+		}
+
+		var pretty bytes.Buffer
+		err = json.Indent(&pretty, buf.Bytes(), "", "\t")
+		if err != nil {
+			return nil, fmt.Errorf("json parse error: %s", err)
+		}
+
+		content = pretty.String()
+		contentline = buf.String()
+	}
+
+	slog.Info("req", "host", req.URL.Host, "uri", req.URL.Path, "body", content, "bodyline", contentline)
+
+	return t.Transport.RoundTrip(req)
+}
+
 func fileExists(filename string) bool {
 	info, err := os.Stat(filename)
 

pkg/es/ccr.go

@@ -23,6 +23,7 @@ import (
 	"log/slog"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )
 
@@ -61,7 +62,7 @@ func CcrStatus(conf *cfg.Config, leader, follower string) error {
 
 		res, err := cat.Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to get indicies on %s: %s", alias, err)
+			return fmt.Errorf("failed to get indicies on %s: %s", alias, esErrorString(err))
 		}
 
 		indices[alias] = make(map[string]*types.IndicesRecord, len(res))
@@ -92,7 +93,7 @@ func CcrRemoteInfo(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower info: %s", err)
+		return fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
 	}
 
 	slog.Debug("ccr remote info", "info", res)
@@ -115,10 +116,10 @@ func CcrRemoteInfo(conf *cfg.Config, index string) error {
 		mode = "leader"
 	}
 
-	table := NewTable(2, 5)
+	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("ccr remote property", "value")
 
-	table.entries = [][]string{
+	table.Entries = [][]string{
 		{"Remote Cluster", remote},
 		{"CCR Mode", mode},
 		{"Connected", fmt.Sprintf("%t", info.Connected)},
@@ -126,7 +127,7 @@ func CcrRemoteInfo(conf *cfg.Config, index string) error {
 		{"Proxy Address", info.ProxyAddress},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 

pkg/es/ccr_follower.go

@@ -22,6 +22,7 @@ import (
 	"log/slog"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 )
 
 func getRemoteName(conf *cfg.Config) (string, error) {
@@ -30,7 +31,7 @@ func getRemoteName(conf *cfg.Config) (string, error) {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return "", fmt.Errorf("failed to retrieve follower info: %s", err)
+		return "", fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
 	}
 
 	remote := ""
@@ -40,7 +41,7 @@ func getRemoteName(conf *cfg.Config) (string, error) {
 	}
 
 	if remote == "" {
-		return "", fmt.Errorf("cluster doesn't have a follower: %s", err)
+		return "", fmt.Errorf("cluster doesn't have a follower")
 	}
 
 	return remote, nil
@@ -95,7 +96,7 @@ func CcrFollowerResume(conf *cfg.Config, index string) error {
 	_, err := create.Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to resume ccr following: %s", err)
+		return fmt.Errorf("failed to resume ccr following: %s", esErrorString(err))
 	}
 
 	return nil
@@ -109,7 +110,7 @@ func CcrFollowerPause(conf *cfg.Config, index string) error {
 	_, err := create.Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to pause ccr following: %s", err)
+		return fmt.Errorf("failed to pause ccr following: %s", esErrorString(err))
 	}
 
 	return nil
@@ -123,7 +124,7 @@ func CcrFollowerUnfollow(conf *cfg.Config, index string) error {
 	_, err := create.Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to unfollow index: %s", err)
+		return fmt.Errorf("failed to unfollow index: %s", esErrorString(err))
 	}
 
 	return nil
@@ -148,7 +149,7 @@ func CcrFollowerAdd(conf *cfg.Config, index string) error {
 	_, err = create.Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to create follower index: %s", err)
+		return fmt.Errorf("failed to create follower index: %s", esErrorString(err))
 	}
 
 	return nil
@@ -160,7 +161,7 @@ func CcrFollowerShow(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower index info: %s", err)
+		return fmt.Errorf("failed to retrieve follower index info: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "follower stats", res.Indices)
@@ -175,10 +176,10 @@ func CcrFollowerShow(conf *cfg.Config, index string) error {
 
 	follower := res.Indices[0].Shards[0]
 
-	table := NewTable(2, 9)
+	table := printer.NewTable(conf, 2, 9)
 	table.Addheaders("ccr follower property", "value")
 
-	table.entries = [][]string{
+	table.Entries = [][]string{
 		{"name", index},
 		{"remote_cluster", follower.RemoteCluster},
 		{"leader_checkpoint", fmt.Sprintf("%d", follower.LeaderGlobalCheckpoint)},
@@ -190,7 +191,7 @@ func CcrFollowerShow(conf *cfg.Config, index string) error {
 		{"successful_write_requests", fmt.Sprintf("%d", follower.SuccessfulWriteRequests)},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 

pkg/es/cluster.go

@@ -25,6 +25,7 @@ import (
 	"sync"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/dustin/go-humanize"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/ccr/stats"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
@@ -52,7 +53,7 @@ type apiResponse struct {
 }
 
 func ClusterList(conf *cfg.Config) error {
-	table := NewTable(3, len(conf.Clusters))
+	table := printer.NewTable(conf, 3, len(conf.Clusters))
 
 	table.Addheaders("cluster", "uri", "default")
 
@@ -76,13 +77,13 @@ func ClusterList(conf *cfg.Config) error {
 			Do(context.Background())
 
 		if err == nil {
-			name = Colorize("green", name)
+			name = printer.Colorize(conf, "green", name)
 		}
 
-		table.entries[idx] = []string{name, cluster.Uri, fmt.Sprintf("%t", current)}
+		table.Entries[idx] = []string{name, cluster.Uri, fmt.Sprintf("%t", current)}
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -162,11 +163,12 @@ func ClusterStatus(conf *cfg.Config) error {
 			)
 		}
 
-		table := NewTable(2, 5)
+		table := printer.NewTable(conf, 2, 7)
 		table.Addheaders(cluster, "status")
 
-		table.entries = [][]string{
-			{"Cluster Name", Colorize(clusterhealth.Status.Name, clusterhealth.ClusterName)},
+		table.Entries = [][]string{
+			{"Cluster Name", clusterhealth.ClusterName},
+			{"ES Status", printer.Colorize(conf, clusterhealth.Status.Name, clusterhealth.Status.Name)},
 			{"ES Version", info.Version.Int},
 			{"Active Shards", fmt.Sprintf("%d", clusterhealth.ActiveShards)},
 			{"Active Primary Shards", fmt.Sprintf("%d", clusterhealth.ActivePrimaryShards)},
@@ -178,7 +180,7 @@ func ClusterStatus(conf *cfg.Config) error {
 			table = gatherClusterStats(conf, clusterstats, table)
 		}
 
-		if err := table.PrintMarkdown(); err != nil {
+		if err := table.Print(); err != nil {
 			return err
 		}
 	}
@@ -186,7 +188,7 @@ func ClusterStatus(conf *cfg.Config) error {
 	return nil
 }
 
-func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, table *Table) *Table {
+func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, table *printer.Table) *printer.Table {
 	var querycount int64
 	var vmversion string
 
@@ -202,7 +204,7 @@ func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, t
 
 	isleader := checkClusterIsLeader(conf, conf.CurrentCluster)
 
-	table.entries = append(table.entries, [][]string{
+	table.Entries = append(table.Entries, [][]string{
 		{"Indicies", fmt.Sprintf("%d", clusterstats.Indices.Count)},
 		{"Is Leader", fmt.Sprintf("%t", isleader)},
 		{"Docs", fmt.Sprintf("%d", clusterstats.Indices.Docs.Count)},

pkg/es/cluster_settings.go

@@ -23,6 +23,7 @@ import (
 	"log/slog"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/urfave/cli/v3"
 )
 
@@ -62,10 +63,10 @@ func ClusterSettingsList(conf *cfg.Config) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get cluster settings: %s", err)
+		return fmt.Errorf("failed to get cluster settings: %s", esErrorString(err))
 	}
 
-	table := NewTable(2, 0)
+	table := printer.NewTable(conf, 2, 0)
 	table.Addheaders("setting", "value")
 	entries := [][]string{}
 
@@ -94,10 +95,10 @@ func ClusterSettingsList(conf *cfg.Config) error {
 		}
 	}
 
-	table.entries = entries
+	table.Entries = entries
 	table.Sort()
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -134,7 +135,7 @@ func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
 		Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to set settings: %s", err)
+		return fmt.Errorf("failed to set settings: %s", esErrorString(err))
 	}
 
 	return nil
@@ -153,7 +154,7 @@ func ClusterSettingsSetSingle(conf *cfg.Config, setting, value string) error {
 		Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to set %s: %s", setting, err)
+		return fmt.Errorf("failed to set %s: %s", setting, esErrorString(err))
 	}
 
 	return nil

pkg/es/cluster_util.go

@@ -25,6 +25,7 @@ import (
 	"sync"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/elastic/go-elasticsearch/v9"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
@@ -40,7 +41,7 @@ func checkClusterIsLeader(conf *cfg.Config, leader string) bool {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		fmt.Printf("failed to get ccr stats from %s: %s", leader, err)
+		fmt.Printf("failed to get ccr stats from %s: %s", leader, esErrorString(err))
 		return false
 	}
 
@@ -67,21 +68,22 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 			Header("accept", "application/json").
 			Do(context.Background())
 		if err != nil {
-			fmt.Printf("failed to get health from %s: %s", cluster, err)
+			fmt.Printf("failed to get health from %s: %s", cluster, esErrorString(err))
 			return false
 		}
 
 		status[cluster] = st
 	}
 
-	table := NewTable(3, 5)
+	table := printer.NewTable(conf, 3, 6)
 
 	table.Addheaders("setting", "leader:"+leader, "follower:"+follower)
 
-	table.entries = [][]string{
-		{"Cluster Name",
-			Colorize(status[leader].Status.Name, status[leader].ClusterName),
-			Colorize(status[follower].Status.Name, status[follower].ClusterName),
+	table.Entries = [][]string{
+		{"Cluster Name", status[leader].ClusterName, status[follower].ClusterName},
+		{"Cluster Status",
+			printer.Colorize(conf, status[leader].Status.Name, status[leader].Status.Name),
+			printer.Colorize(conf, status[follower].Status.Name, status[follower].Status.Name),
 		},
 		{"Active Shards",
 			fmt.Sprintf("%d", status[leader].ActiveShards),
@@ -101,11 +103,13 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 		},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		fmt.Println(err)
 		return false
 	}
 
+	fmt.Println()
+
 	if status[leader].Status.Name == "green" && status[follower].Status.Name == "green" {
 		return true
 	}
@@ -124,7 +128,7 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
 			Header("accept", "application/json").
 			Do(context.Background())
 		if err != nil {
-			fmt.Printf("failed to get ilm status from %s: %s", cluster, err)
+			fmt.Printf("failed to get ilm status from %s: %s", cluster, esErrorString(err))
 			return false
 		}
 
@@ -151,17 +155,17 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
 
 		if len(failed[cluster]) > 0 {
 			idx := 0
-			table := NewTable(2, len(failed[cluster]))
+			table := printer.NewTable(conf, 2, len(failed[cluster]))
 			table.Addheaders("ilm errors on "+which, "errors")
 
 			for name, count := range failed[cluster] {
-				table.entries[idx] = []string{name, count}
+				table.Entries[idx] = []string{name, count}
 				idx++
 			}
 
 			table.Sort()
 
-			if err := table.PrintMarkdown(); err != nil {
+			if err := table.Print(); err != nil {
 				fmt.Println(err)
 				return false
 			}
@@ -223,18 +227,18 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 	}
 
 	idx := 0
-	table := NewTable(3, len(indexOnlyOnLeader))
+	table := printer.NewTable(conf, 3, len(indexOnlyOnLeader))
 	table.Addheaders("index only on leader", "size", "docscount")
 
 	for name, index := range indexOnlyOnLeader {
-		name := Colorize("red", name)
+		name := printer.Colorize(conf, "red", name)
 
-		table.entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		fmt.Println(err)
 		return false
 	}
@@ -273,18 +277,18 @@ func findOrphanedIndices(conf *cfg.Config, indices ClusterIndices, leader, follo
 	}
 
 	idx := 0
-	table := NewTable(3, len(orphaned))
+	table := printer.NewTable(conf, 3, len(orphaned))
 	table.Addheaders("orphaned index on follower", "size", "docscount")
 
 	for name, index := range orphaned {
-		name := Colorize("red", name)
+		name := printer.Colorize(conf, "red", name)
 
-		table.entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		fmt.Println(err)
 		return false
 	}
@@ -307,18 +311,18 @@ func findFailedFollowerIndices(conf *cfg.Config, indices ClusterIndices, followe
 	}
 
 	idx := 0
-	table := NewTable(3, len(red))
+	table := printer.NewTable(conf, 3, len(red))
 	table.Addheaders("red index on follower", "size", "docscount")
 
 	for name, index := range red {
-		name := Colorize("red", name)
+		name := printer.Colorize(conf, "red", name)
 
-		table.entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		fmt.Println(err)
 		return false
 	}

pkg/es/doc.go

@@ -19,10 +19,15 @@ package es
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"time"
+	"math/rand/v2"
+	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/core/deletebyquery"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
+	"github.com/tidwall/gjson"
 )
 
 // create index with:
@@ -32,7 +37,7 @@ import (
 // then add a doc:
 //
 // esctl doc add foo2 '{"id":"d8d8d","user":"scip"}'
-func DocAdd(conf *cfg.Config, index, jsondoc string) error {
+func DocAdd(conf *cfg.Config, jsondoc string) error {
 	data := map[string]any{}
 
 	err := json.Unmarshal([]byte(jsondoc), &data)
@@ -40,15 +45,87 @@ func DocAdd(conf *cfg.Config, index, jsondoc string) error {
 		return fmt.Errorf("supplied document was not valid JSON: %s", err)
 	}
 
-	now := fmt.Sprintf("%d", time.Now().Unix())
+	now := fmt.Sprintf("%d", rand.Int64())
 
-	_, err = conf.DefaultCluster.ES.Create(index, now).
+	res, err := conf.DefaultCluster.ES.Create(conf.Index, now).
 		Document(data).
 		Header("content-type", "application/json").
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to create new doc in index %s: %s", index, err)
+		return fmt.Errorf("failed to create new doc in index %s: %s", conf.Index, esErrorString(err))
+	}
+
+	fmt.Println(res.Id_)
+
+	return nil
+}
+
+func DocShow(conf *cfg.Config, id string) error {
+	res, err := conf.DefaultCluster.ES.Get(conf.Index, id).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to retrieve doc in index %s: %s", conf.Index, esErrorString(err))
+	}
+
+	if !res.Found {
+		return errors.New("no document with that id found")
+	}
+
+	docjson := fmt.Sprintf(`{"id":%s, "index":"%s", "source":%s}`,
+		res.Id_,
+		res.Index_,
+		res.Source_)
+
+	if conf.Path != "" {
+		value := gjson.Get(docjson, conf.Path)
+		fmt.Println(value.String())
+	} else {
+		fmt.Println(docjson)
+	}
+
+	fmt.Println()
+
+	return nil
+}
+
+func DocDelete(conf *cfg.Config, queries []string) error {
+	if len(queries) == 1 && strings.Contains(queries[0], "id=") {
+		id, _ := strings.CutPrefix(queries[0], "id=")
+
+		_, err := conf.DefaultCluster.ES.Delete(conf.Index, id).
+			Header("content-type", "application/json").
+			Header("accept", "application/json").
+			Do(context.Background())
+		if err != nil {
+			return fmt.Errorf("failed to delete doc in index %s: %s", conf.Index, esErrorString(err))
+		}
+
+		return nil
+	}
+
+	req := &deletebyquery.Request{}
+
+	if len(queries) == 0 && conf.All {
+		req.Query = esdsl.NewMatchAllQuery().QueryCaster()
+	} else {
+		queryCaster, err := prepareQuery(conf, queries)
+		if err != nil {
+			return err
+		}
+
+		req.Query = queryCaster
+	}
+
+	_, err := conf.DefaultCluster.ES.DeleteByQuery(conf.Index).
+		Request(req).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to delete docs in index %s: %s", conf.Index, esErrorString(err))
 	}
 
 	return nil

pkg/es/errors.go

@@ -0,0 +1,45 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"fmt"
+
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+func esErrorString(err error) string {
+	msg := err.Error()
+
+	switch e := err.(type) {
+	case *types.ElasticsearchError:
+		causes := ""
+
+		for _, cause := range e.ErrorCause.RootCause {
+			causes += fmt.Sprintf("%s\n", *cause.Reason)
+		}
+
+		if e.ErrorCause.Reason != nil {
+			msg = *e.ErrorCause.Reason + ": " + causes
+		} else {
+			msg = fmt.Sprintf("http status %d: ", e.Status)
+		}
+
+	}
+
+	return msg
+}

pkg/es/index.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/healthstatus"
@@ -39,7 +40,7 @@ func IndexNames(conf *cfg.Config) ([]string, error) {
 		Do(context.Background())
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to get indicies: %s", err)
+		return nil, fmt.Errorf("failed to get indicies: %s", esErrorString(err))
 	}
 
 	indices := make([]string, len(res))
@@ -80,7 +81,7 @@ func IndexList(conf *cfg.Config) error {
 
 	res, err := cat.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", err)
+		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "indicies", res)
@@ -95,13 +96,13 @@ func IndexList(conf *cfg.Config) error {
 		}
 	}
 
-	table := NewTable(3, size)
+	table := printer.NewTable(conf, 3, size)
 	table.Addheaders("name", "size", "docscount")
 
 	for idx, index := range list {
-		name := Colorize(*index.Health, *index.Index)
+		name := printer.Colorize(conf, *index.Health, *index.Index)
 
-		table.entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
 
 		if idx == size-1 {
 			break
@@ -109,7 +110,7 @@ func IndexList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -123,12 +124,19 @@ func IndexShow(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get index: %s", err)
+		return fmt.Errorf("failed to get index: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "index", res)
 
-	table := NewTable(2, 5)
+	fields := make([]string, len(res[index].Mappings.Properties))
+	idx := 0
+	for field := range res[index].Mappings.Properties {
+		fields[idx] = field
+		idx++
+	}
+
+	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("index property", "value")
 
 	ts, err := strconv.ParseInt(res[index].Settings.Index.CreationDate.(string), 10, 64)
@@ -138,15 +146,16 @@ func IndexShow(conf *cfg.Config, index string) error {
 
 	created := time.Unix(ts/1000, 0)
 
-	table.entries = [][]string{
+	table.Entries = [][]string{
 		{"name", index},
 		{"replicas", *res[index].Settings.Index.NumberOfReplicas},
 		{"shards", *res[index].Settings.Index.NumberOfShards},
 		{"created", created.Format("2006-01-02 15:04:05")},
 		{"uuid", *res[index].Settings.Index.Uuid},
+		{"fields", strings.Join(fields, ",")},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -199,7 +208,7 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 		Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to create index: %s", err)
+		return fmt.Errorf("failed to create index: %s", esErrorString(err))
 	}
 
 	return nil
@@ -211,7 +220,7 @@ func IndexDelete(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete index: %s", err)
+		return fmt.Errorf("failed to delete index: %s", esErrorString(err))
 	}
 
 	return nil
@@ -225,7 +234,7 @@ func IndexClose(conf *cfg.Config, index string) error {
 	_, err := create.Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to close index: %s", err)
+		return fmt.Errorf("failed to close index: %s", esErrorString(err))
 	}
 
 	return nil
@@ -240,14 +249,14 @@ func IndexAllocation(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get index allocation explain: %s", err)
+		return fmt.Errorf("failed to get index allocation explain: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "index", res)
 
 	currentNode := res.CurrentNode
 
-	table := NewTable(2, 10)
+	table := printer.NewTable(conf, 2, 10)
 	table.Addheaders("index allocation setting", "value")
 
 	roles := make([]string, len(currentNode.Roles))
@@ -255,7 +264,7 @@ func IndexAllocation(conf *cfg.Config, index string) error {
 		roles[idx] = role.Name
 	}
 
-	table.entries = [][]string{
+	table.Entries = [][]string{
 		{"Index", index},
 		{"Current node", currentNode.Name},
 		{"Current k8s node", currentNode.Attributes["k8s_node_name"]},
@@ -268,7 +277,7 @@ func IndexAllocation(conf *cfg.Config, index string) error {
 		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -285,7 +294,44 @@ func IndexModify(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to modify index settings: %s", err)
+		return fmt.Errorf("failed to modify index settings: %s", esErrorString(err))
+	}
+
+	return nil
+}
+
+func IndexFields(conf *cfg.Config, index string) error {
+	res, err := conf.DefaultCluster.ES.FieldCaps().
+		Index(index).
+		Fields("*").
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to retrieve field capabilties: %s", esErrorString(err))
+	}
+
+	table := printer.NewTable(conf, 5, len(res.Fields))
+	table.Addheaders("field", "type", "searchable", "aggretable", "metadata")
+
+	idx := 0
+	for name, field := range res.Fields {
+		for fieldtype, caps := range field {
+			// fields only have 1 type, so this one is it
+			table.Entries[idx] = []string{name, fieldtype,
+				fmt.Sprintf("%t", caps.Searchable),
+				fmt.Sprintf("%t", caps.Aggregatable),
+				fmt.Sprintf("%t", *caps.MetadataField)}
+			break
+		}
+
+		idx++
+	}
+
+	table.Sort()
+
+	if err := table.Print(); err != nil {
+		return err
 	}
 
 	return nil

pkg/es/index_alias.go

@@ -24,20 +24,20 @@ import (
 	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 )
 
 // FIXME: add filter support, see IndexCreate mapping
 func IndexAliasCreate(conf *cfg.Config, index, alias string) error {
-	create := conf.DefaultCluster.ES.Indices.PutAlias(index, alias).
+	res, err := conf.DefaultCluster.ES.Indices.PutAlias(index, alias).
 		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	res, err := create.Do(context.Background())
+		Header("accept", "application/json").
+		Do(context.Background())
 
 	slog.Debug("create alias", "result", res)
 
 	if err != nil {
-		return fmt.Errorf("failed to create index alias: %s", err)
+		return fmt.Errorf("failed to create index alias: %s", esErrorString(err))
 	}
 
 	return nil
@@ -51,15 +51,14 @@ func IndexAliasList(conf *cfg.Config) error {
 		filter = *regexp.MustCompile(conf.Filter[0])
 	}
 
-	create := conf.DefaultCluster.ES.Indices.GetAlias().
+	res, err := conf.DefaultCluster.ES.Indices.GetAlias().
 		Index("_all").
 		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	res, err := create.Do(context.Background())
+		Header("accept", "application/json").
+		Do(context.Background())
 
 	if err != nil {
-		return fmt.Errorf("failed to list index aliases: %s", err)
+		return fmt.Errorf("failed to list index aliases: %s", esErrorString(err))
 	}
 
 	slog.Debug("aliases list", "result", res)
@@ -78,12 +77,12 @@ func IndexAliasList(conf *cfg.Config) error {
 		}
 	}
 
-	table := NewTable(2, len(aliaslist))
+	table := printer.NewTable(conf, 2, len(aliaslist))
 	table.Addheaders("index", "alias")
 
 	idx := 0
 	for index, aliases := range aliaslist {
-		table.entries[idx] = []string{
+		table.Entries[idx] = []string{
 			index,
 			strings.Join(aliases, ","),
 		}
@@ -93,9 +92,24 @@ func IndexAliasList(conf *cfg.Config) error {
 
 	table.Sort()
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func IndexAliasDelete(conf *cfg.Config, index, alias string) error {
+	res, err := conf.DefaultCluster.ES.Indices.DeleteAlias(index, alias).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+
+	slog.Debug("delete alias", "result", res)
+
+	if err != nil {
+		return fmt.Errorf("failed to delete index alias: %s", esErrorString(err))
+	}
+
+	return nil
+}

pkg/es/node.go

@@ -22,22 +22,23 @@ import (
 	"log/slog"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 )
 
 func NodeList(conf *cfg.Config) error {
 	// get nodes
 	nodes, err := conf.DefaultCluster.ES.Cat.Nodes().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get nodes: %s", err)
+		return fmt.Errorf("failed to get nodes: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "nodes", nodes)
 
-	table := NewTable(7, len(nodes))
+	table := printer.NewTable(conf, 7, len(nodes))
 	table.Addheaders("name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
 
 	for idx, node := range nodes {
-		table.entries[idx] = []string{
+		table.Entries[idx] = []string{
 			*node.Name,
 			*node.Ip,
 			*node.Load1M,
@@ -49,7 +50,7 @@ func NodeList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 

pkg/es/repl.go

@@ -17,6 +17,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package es
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"crypto/tls"
@@ -34,19 +35,98 @@ import (
 	"github.com/chzyer/readline"
 )
 
+const intro = `Input format: verb path [data]"
+
+Example:
+
+post /yourindex/_ccr/pause_follow
+put /yourindex/_settings {"number_of_replicas": 1}
+
+You can also put multiline JSON after the path like:
+
+put /yourindex/_settings
+{
+  "number_of_replicas": 1
+}
+
+If you do NOT  supply a JSON in the first line, you  need to hit ENTER
+twice to complete.`
+
+func Repl(conf *cfg.Config) error {
+	verbs := []string{"post", "get", "put", "delete"}
+
+	fmt.Println(intro)
+	fmt.Println()
+
+	reader, err := readline.NewEx(&readline.Config{
+		Prompt:            "> ",
+		HistoryFile:       os.Getenv("HOME") + "/.config/esctl/history",
+		HistoryLimit:      500,
+		InterruptPrompt:   "^C",
+		EOFPrompt:         "exit",
+		HistorySearchFold: true,
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to initialize readline lib: %s", err)
+	}
+
+	for {
+		text, err := reader.Readline()
+		if err != nil {
+			break
+		}
+
+		text = strings.TrimSpace(text)
+
+		if text == "" {
+			continue
+		}
+
+		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
+		if len(parts) < 2 {
+			fmt.Println("error: you need to input a verb, uri [and post data]")
+			continue
+		}
+
+		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
+			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
+			continue
+		}
+
+		if !strings.HasPrefix(parts[1], "/") {
+			parts[1] = "/" + parts[1]
+		}
+
+		json := ""
+		if len(parts) == 3 {
+			// put /uri {json}
+			json = parts[2]
+		}
+
+		// put /uri/<Ret> [json]
+		data, err := readJSON(json)
+		if err != nil {
+			fmt.Println(err)
+		}
+
+		err = CallAPI(conf, parts[0], parts[1], data)
+		if err != nil {
+			fmt.Printf("failed to call API: %s\n", esErrorString(err))
+		}
+
+		reader.SetPrompt("> ")
+	}
+
+	return nil
+}
+
 func encodeAuth(username, password string) string {
 	return base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
 }
 
-func CallAPI(conf *cfg.Config, input []string) error {
-	var data string
-
-	verb := strings.ToUpper(input[0])
-	path := input[1]
-
-	if len(input) == 3 {
-		data = input[2]
-	}
+func CallAPI(conf *cfg.Config, verb, path, data string) error {
+	verb = strings.ToUpper(verb)
 
 	// we're using port-forwards anyway
 	tr := &http.Transport{
@@ -108,69 +188,37 @@ func prettyfiJson(conf *cfg.Config, raw []byte) error {
 	return nil
 }
 
-func Repl(conf *cfg.Config) error {
-	verbs := []string{"post", "get", "put", "delete"}
+// interactively  read  arbitrary  JSON  data  from  STDIN,  which  is
+// virtually a repl inside the primary repl
+func readJSON(input string) (string, error) {
+	data := ""
 
-	fmt.Println("Input format: verb path [data]")
-	fmt.Println("example: post /yourindex/_ccr/pause_follow")
+	if input != "" {
+		data = input
+	} else {
+		scanner := bufio.NewScanner(os.Stdin)
+		for scanner.Scan() {
+			line := strings.TrimSpace(scanner.Text())
 
-	reader, err := readline.NewEx(&readline.Config{
-		Prompt:            "> ",
-		HistoryFile:       os.Getenv("HOME") + "/.config/esctl/history",
-		HistoryLimit:      500,
-		InterruptPrompt:   "^C",
-		EOFPrompt:         "exit",
-		HistorySearchFold: true,
-	})
-
-	if err != nil {
-		return fmt.Errorf("failed to initialize readline lib: %s", err)
-	}
-
-	for {
-		text, err := reader.Readline()
-		if err != nil {
-			break
-		}
-
-		text = strings.TrimSpace(text)
-
-		if text == "" {
-			continue
-		}
-
-		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
-		if len(parts) < 2 {
-			fmt.Println("error: you need to input a verb, uri [and post data]")
-			continue
-		}
-
-		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
-			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
-			continue
-		}
-
-		if !strings.HasPrefix(parts[1], "/") {
-			fmt.Println("error: url path must start with /")
-			continue
-		}
-
-		if len(parts) == 3 {
-			data := map[string]any{}
-			err := json.Unmarshal([]byte(parts[2]), &data)
-			if err != nil {
-				fmt.Printf("error: input data is not proper JSON: %s", err)
-				continue
+			if line == "" {
+				break
 			}
-		}
 
-		err = CallAPI(conf, parts)
-		if err != nil {
-			fmt.Printf("failed to call API: %s\n", err)
+			data += line
 		}
-
-		reader.SetPrompt("> ")
 	}
 
-	return nil
+	if data == "" {
+		return data, nil
+	}
+
+	// validate
+	check := map[string]any{}
+	err := json.Unmarshal([]byte(data), &check)
+	if err != nil {
+		return "", fmt.Errorf("error: input data is not proper JSON: %s", err)
+
+	}
+
+	return data, nil
 }

pkg/es/role.go

@@ -0,0 +1,228 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+func RoleList(conf *cfg.Config) error {
+	res, err := conf.DefaultCluster.ES.Security.GetRole().
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "roles", res)
+
+	table := printer.NewTable(conf, 3, len(res))
+	table.Addheaders("role", "index roles", "cluster roles")
+
+	idx := 0
+	for name, role := range res {
+		table.Entries[idx] = []string{
+			name,
+			fmt.Sprintf("%d", len(role.Cluster)),
+			fmt.Sprintf("%d", len(role.Indices)),
+		}
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+func RoleShow(conf *cfg.Config, rolename string) error {
+	res, err := conf.DefaultCluster.ES.Security.GetRole().
+		Name(rolename).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "role", res)
+
+	role, exists := res[rolename]
+	if !exists {
+		return fmt.Errorf("role %s does not exist", rolename)
+	}
+
+	if len(role.Indices) > 0 {
+		if err := roleIndices(conf, role); err != nil {
+			return err
+		}
+
+		fmt.Println()
+	}
+
+	if len(role.RemoteIndices) > 0 {
+		if err := roleRemoteIndices(conf, role); err != nil {
+			return err
+		}
+
+		fmt.Println()
+	}
+
+	if len(role.Cluster) > 0 {
+		if err := roleClusters(conf, role); err != nil {
+			return err
+		}
+
+		fmt.Println()
+	}
+
+	if len(role.RemoteCluster) > 0 {
+		if err := roleRemoteClusters(conf, role); err != nil {
+			return err
+		}
+
+		fmt.Println()
+	}
+
+	if len(role.Applications) > 0 {
+		if err := roleApplications(conf, role); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func roleRemoteClusters(conf *cfg.Config, role types.Role) error {
+	if len(role.RemoteCluster) == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, 2, len(role.RemoteCluster))
+	table.Addheaders("remote cluster", "privilege")
+	idx := 0
+	for _, priv := range role.RemoteCluster {
+		perms := []string{}
+		for _, perm := range priv.Privileges {
+			perms = append(perms, perm.Name)
+		}
+
+		table.Entries[idx] = []string{
+			strings.Join(priv.Clusters, ","),
+			strings.Join(perms, ","),
+		}
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+func roleClusters(conf *cfg.Config, role types.Role) error {
+	if len(role.Cluster) == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, 1, len(role.Cluster))
+	table.Addheaders("cluster rights")
+	idx := 0
+	for _, cluster := range role.Cluster {
+		table.Entries[idx] = []string{cluster.Name}
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+func roleRemoteIndices(conf *cfg.Config, role types.Role) error {
+	if len(role.RemoteIndices) == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, 3, len(role.RemoteIndices))
+	table.Addheaders("remote index names", "index permissions", "allow restricted")
+	idx := 0
+	for _, priv := range role.RemoteIndices {
+		perms := []string{}
+		for _, perm := range priv.Privileges {
+			perms = append(perms, perm.Name)
+		}
+
+		table.Entries[idx] = []string{
+			strings.Join(priv.Names, ", "),
+			strings.Join(perms, ", "),
+			fmt.Sprintf("%t", *priv.AllowRestrictedIndices),
+		}
+
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+func roleIndices(conf *cfg.Config, role types.Role) error {
+	if len(role.Indices) == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, 3, len(role.Indices))
+	table.Addheaders("index names", "index permissions", "allow restricted")
+	idx := 0
+	for _, priv := range role.Indices {
+		perms := []string{}
+		for _, perm := range priv.Privileges {
+			perms = append(perms, perm.Name)
+		}
+
+		table.Entries[idx] = []string{
+			strings.Join(priv.Names, ", "),
+			strings.Join(perms, ", "),
+			fmt.Sprintf("%t", *priv.AllowRestrictedIndices),
+		}
+
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}
+
+func roleApplications(conf *cfg.Config, role types.Role) error {
+	if len(role.Applications) == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, 3, len(role.Applications))
+	table.Addheaders("application", "privileges", "resources")
+	idx := 0
+	for _, priv := range role.Applications {
+		table.Entries[idx] = []string{
+			priv.Application,
+			strings.Join(priv.Privileges, ", "),
+			strings.Join(priv.Resources, ", "),
+		}
+
+		idx++
+	}
+
+	table.Sort()
+	return table.Print()
+}

pkg/es/role_diff.go

@@ -0,0 +1,354 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/csv"
+	"fmt"
+	"log"
+	"log/slog"
+	"os"
+	"slices"
+	"strings"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/alecthomas/repr"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/security/getrole"
+)
+
+// use static csv  record positions as const vars so  we can modify it
+// if the csv format ever changes
+const (
+	Rindexname = iota
+	Rrole
+	Rindexprivilege
+	Rclusterprivilege
+	Radgroup
+	Rspace
+	Rretention
+	Rkibanaprivilege
+	Rfieldprivilege
+)
+
+type Record struct {
+	// filled from CSV input
+	index_name        string
+	role              string
+	index_privilege   string
+	cluster_privilege []string
+	ad_group          []string
+	space             string
+	retention         string
+	kibana_privilege  string
+	field_privilege   string
+
+	// set by ourselfes
+	defined bool
+}
+
+type Register struct {
+	name              string
+	deployed, defined bool
+}
+
+// generic variant,  we do not account  for multiple rows of  the same
+// role,  in  such  cases  an   entry  will  simply  overwritten.  Use
+// getCsvRecord() for a single role.
+func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error) {
+	data, err := os.ReadFile(csvfile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read CSV file: %s", err)
+	}
+
+	csvreader := csv.NewReader(bytes.NewReader(data))
+	csvreader.Comma = rune(conf.Separator[0])
+	csvreader.Comment = '#'
+	csvreader.TrimLeadingSpace = true
+
+	rows, err := csvreader.ReadAll()
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse CSV: %s", err)
+	}
+
+	records := make(map[string]Record, len(rows)-1)
+
+	for idx, row := range rows {
+		if idx == 0 {
+			continue // header
+		}
+
+		records[row[1]] = Record{
+			index_name:        row[Rindexname],
+			role:              row[Rrole],
+			index_privilege:   row[Rindexprivilege],
+			cluster_privilege: []string{row[Rindexprivilege]},
+			ad_group:          []string{row[Rclusterprivilege]},
+			space:             row[Rspace],
+			retention:         row[Rretention],
+			kibana_privilege:  row[Rkibanaprivilege],
+			field_privilege:   row[Rfieldprivilege],
+			defined:           true,
+		}
+	}
+
+	return records, nil
+}
+
+// same thing  as above but  for one specific role.  supports multiple
+// rows  of  the same  record  with  different  values which  will  be
+// combined.
+func getCsvRecord(conf *cfg.Config, csvfile, rolename string) (*Record, error) {
+	fd, err := os.Open(csvfile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open CSV file: %s", err)
+	}
+	defer func() {
+		if err := fd.Close(); err != nil {
+			log.Fatalf("failed to close file: %s", err)
+		}
+	}()
+
+	scanner := bufio.NewScanner(fd)
+	record := Record{role: rolename}
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "#") || line == "" {
+			continue
+		}
+
+		row := strings.Split(line, conf.Separator)
+
+		if row[Rrole] == rolename {
+			record.index_name = row[Rindexname]
+			record.index_privilege = row[Rindexprivilege]
+			record.cluster_privilege = strings.Split(row[Rclusterprivilege], ",")
+			record.ad_group = append(record.ad_group, row[Radgroup])
+			record.space = row[Rspace]
+			record.retention = row[Rretention]
+			record.kibana_privilege = row[Rkibanaprivilege]
+			record.field_privilege = row[Rfieldprivilege]
+			record.defined = true
+		}
+	}
+
+	return &record, nil
+}
+
+func diffRoles(conf *cfg.Config, records map[string]Record, res getrole.Response) []Register {
+	rows := []Register{}
+	filtered := []Register{}
+	deployed := map[string]int{}
+
+	// iterate over deployed roles
+	for name := range res {
+		reg := Register{name: name}
+
+		_, defined := records[name]
+		if defined {
+			reg.deployed = true
+			reg.defined = true
+		} else {
+			reg.deployed = true
+			reg.defined = false
+		}
+
+		deployed[name] = 1
+
+		rows = append(rows, reg)
+	}
+
+	// iterate over records from CSV and register only those which are not deployed
+	for name := range records {
+		reg := Register{name: name, defined: true}
+		_, deployed := deployed[name]
+		if !deployed {
+			rows = append(rows, reg)
+		}
+	}
+
+	for _, reg := range rows {
+		if (conf.NotDeployed && !reg.deployed) ||
+			(conf.Undefined && !reg.defined) ||
+			(conf.Diff && reg.deployed != reg.defined) ||
+			(!conf.Undefined && !conf.NotDeployed && !conf.Diff) {
+			filtered = append(filtered, reg)
+		}
+	}
+
+	return filtered
+}
+
+func RoleDiff(conf *cfg.Config, csvfile, role string) error {
+	records, err := getCsvRecords(conf, csvfile)
+	if err != nil {
+		return err
+	}
+
+	if role != "" {
+		return RoleDiffSingle(conf, csvfile, role)
+	}
+
+	res, err := conf.DefaultCluster.ES.Security.GetRole().
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+	}
+
+	rows := diffRoles(conf, records, res)
+
+	table := printer.NewTable(conf, 3, len(rows))
+	table.Addheaders("role", "is deployed", "is defined")
+
+	for idx, row := range rows {
+		deployed := printer.Colorize(conf, "green", "deployed")
+		if !row.deployed {
+			deployed = printer.Colorize(conf, "red", "not deployed")
+		}
+
+		defined := printer.Colorize(conf, "green", "defined")
+		if !row.defined {
+			defined = printer.Colorize(conf, "red", "undefined")
+		}
+
+		table.Entries[idx] = []string{
+			row.name,
+			deployed,
+			defined,
+		}
+	}
+
+	table.Sort()
+
+	return table.Print()
+}
+
+func getRoleMappingGroups(conf *cfg.Config, rolename string) ([]string, error) {
+	mappings, err := conf.DefaultCluster.ES.Security.GetRoleMapping().
+		Do(context.Background())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get role mappings: %s", esErrorString(err))
+	}
+
+	groups := []string{}
+	for _, mapping := range mappings {
+		if slices.Contains(mapping.Roles, rolename) {
+			for _, rule := range mapping.Rules.Any {
+				for _, group := range rule.Field["groups"] {
+					groups = append(groups, group.(string))
+				}
+			}
+		}
+	}
+
+	return groups, nil
+}
+
+func compareSlices(name string, a, b []string) {
+	slices.Sort(a)
+	slices.Sort(b)
+
+	if slices.Compare(a, b) != 0 {
+		fmt.Printf("%s differs:\ndeployed: %s\n     csv: %s\n",
+			name, strings.Join(a, ","), strings.Join(b, ","))
+	} else {
+		fmt.Printf("deployed %s matches csv definition\n", name)
+	}
+}
+
+func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
+	res, err := conf.DefaultCluster.ES.Security.GetRole().
+		Name(rolename).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+	}
+
+	record, err := getCsvRecord(conf, csvfile, rolename)
+	if err != nil {
+		return err
+	}
+
+	if !record.defined {
+		fmt.Printf("role %s is not defined\n", rolename)
+		return nil
+	}
+
+	role, exists := res[rolename]
+	if !exists {
+		fmt.Printf("role %s is not deployed\n", rolename)
+		return nil
+	} else {
+		fmt.Printf("role %s is deployed\n", rolename)
+	}
+	slog.Debug("found role", "role", role)
+
+	if conf.Debug {
+		// slog.Debug doesn't print it, for whatever reason
+		repr.Println(record)
+	}
+
+	groups, err := getRoleMappingGroups(conf, rolename)
+	if err != nil {
+		return err
+	}
+	slog.Debug("group mappings", "groups", groups)
+
+	// check cluster setting
+	clusters := []string{}
+	for _, cluster := range role.Cluster {
+		clusters = append(clusters, cluster.Name)
+	}
+
+	// check index names+privs
+	indices := []string{}
+	privs := []string{}
+	for _, index := range role.Indices {
+		for _, name := range index.Names {
+			indices = append(indices, strings.ReplaceAll(name, "**", "*"))
+		}
+
+		for _, priv := range index.Privileges {
+			privs = append(privs, priv.Name)
+		}
+	}
+
+	// check kibana application space
+	spaces := []string{}
+	for _, app := range role.Applications {
+		for _, resource := range app.Resources {
+			if strings.Contains(resource, "space:") {
+				parts := strings.Split(resource, ":")
+				if len(parts) == 2 {
+					spaces = append(spaces, parts[1])
+				}
+			}
+		}
+	}
+
+	compareSlices("cluster_privilege", clusters, record.cluster_privilege)
+	compareSlices("ad_group", groups, record.ad_group)
+	compareSlices("index_name", indices, []string{record.index_name})
+	compareSlices("index_privilege", privs, []string{record.index_privilege})
+	compareSlices("space", spaces, []string{record.space})
+
+	return nil
+}

pkg/es/search.go

@@ -19,13 +19,21 @@ package es
 import (
 	"context"
 	"fmt"
+	"log"
 	"log/slog"
-	"strings"
+	"time"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/alecthomas/repr"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/core/search"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/sortorder"
+)
+
+const (
+	MAXPAGE = 5000
 )
 
 /*
@@ -35,49 +43,145 @@ Execute an ES search.
 	additional filters can be given as -F key=value
 */
 func Search(conf *cfg.Config, queries []string) error {
-	query := esdsl.NewBoolQuery()
+	searchEs := conf.DefaultCluster.ES.Search().
+		Index(conf.Index)
 
-	for _, q := range queries {
-		parts := strings.Split(q, "=")
-		if len(parts) != 2 {
-			return fmt.Errorf("search queries must be in the form field=pattern")
+	queryCaster, err := prepareQuery(conf, queries)
+	if err != nil {
+		return err
+	}
+
+	req := &search.Request{Query: queryCaster}
+
+	searchEs.Request(req)
+
+	searchEs = addSort(conf, searchEs)
+
+	switch conf.Tail {
+	case true:
+		return searchTail(conf, searchEs)
+	default:
+		if conf.To > MAXPAGE {
+			return searchPit(conf, req)
+		} else {
+			return searchOnce(conf, searchEs)
 		}
-
-		query.Must(esdsl.NewMatchQuery(parts[0], parts[1]))
-	}
-
-	filters := make([]types.QueryVariant, len(conf.Filter))
-
-	for idx, filter := range conf.Filter {
-		parts := strings.Split(filter, "=")
-		if len(parts) != 2 {
-			return fmt.Errorf("invalid filter spec: %s, expecting key=value", filter)
-		}
-
-		filters[idx] = esdsl.NewTermQuery(parts[0], esdsl.NewFieldValue().String(parts[1]))
-	}
-
-	if len(filters) > 0 {
-		query.Filter(filters...)
 	}
+}
 
+func Debug(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES.Search().
 		Index(conf.Index).
-		Request(&search.Request{
-			Query: query.QueryCaster(),
-			From:  &conf.From,
-			Size:  &conf.To,
+		Size(0).
+		Aggregations(map[string]types.Aggregations{
+			"min_ts": *esdsl.NewMinAggregation().Field("@timestamp").AggregationsCaster(),
+			"max_ts": *esdsl.NewMaxAggregation().Field("@timestamp").AggregationsCaster(),
 		}).
 		Do(context.Background())
+
 	if err != nil {
-		return fmt.Errorf("failed to run search (esdsl): %s", err)
+		return err
+	}
+
+	repr.Println(res)
+
+	return nil
+}
+
+func searchOnce(conf *cfg.Config, search *search.Search) error {
+	res, err := search.
+		From(conf.From).
+		Size(conf.To).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "search", res)
 
 	for _, hit := range res.Hits.Hits {
-		fmt.Printf("%s\n", hit.Source_)
+		printer.PrintDoc(conf, hit)
 	}
 
 	return nil
 }
+
+// https://www.elastic.co/docs/reference/elasticsearch/clients/go/using-the-api/searching#_pit_search_after
+func searchPit(conf *cfg.Config, req *search.Request) error {
+	ctx := context.Background()
+	pit, err := conf.DefaultCluster.ES.OpenPointInTime(conf.Index).KeepAlive("1m").Do(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to open point-in-time request for search: %s", err)
+	}
+	defer func() {
+		_, err := conf.DefaultCluster.ES.ClosePointInTime().Id(pit.Id).Do(ctx)
+		if err != nil {
+			log.Fatalf("failed to close PIT: %s", err)
+		}
+	}()
+
+	search := conf.DefaultCluster.ES.Search().
+		Request(req).
+		Pit(esdsl.NewPointInTimeReference().
+			Id(pit.Id).
+			KeepAlive(esdsl.NewDuration().String("1m"))).
+		Sort(esdsl.NewSortOptions().
+			AddSortOption("_shard_doc", esdsl.NewFieldSort(sortorder.Asc))).
+		Size(conf.To)
+
+	search = addSort(conf, search)
+
+	for {
+		res, err := search.Do(ctx)
+		if err != nil {
+			return fmt.Errorf("failed to run search (esdsl pit): %s", esErrorString(err))
+		}
+
+		if len(res.Hits.Hits) == 0 {
+			break
+		}
+
+		for _, hit := range res.Hits.Hits {
+			printer.PrintDoc(conf, hit)
+		}
+
+		last := res.Hits.Hits[len(res.Hits.Hits)-1]
+		search = search.SearchAfterValues(last.Sort)
+
+		if res.PitId != nil {
+			search = search.Pit(esdsl.NewPointInTimeReference().
+				Id(*res.PitId).
+				KeepAlive(esdsl.NewDuration().String("1m")))
+		}
+	}
+
+	return nil
+}
+
+func searchTail(conf *cfg.Config, search *search.Search) error {
+	docs := map[string]int{}
+
+	fmt.Println("enter ctrl-c to abort...")
+
+	for {
+		res, err := search.Do(context.Background())
+		if err != nil {
+			return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
+		}
+
+		slog.Debug("ES result", "search", res)
+
+		for _, hit := range res.Hits.Hits {
+			_, exists := docs[*hit.Id_]
+			if exists {
+				continue
+			}
+
+			printer.PrintDoc(conf, hit)
+
+			docs[*hit.Id_] = 1
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+}

pkg/es/search_filter.go

@@ -0,0 +1,280 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/core/search"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/operator"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/sortorder"
+)
+
+const (
+	Fmust = iota
+	Fmustnot
+	Fshould
+)
+
+// hold filter configuration, can be used multiple times through a search
+type filter struct {
+	term, filter string   // message=foo
+	mterm        []string // multi_match
+	criteria     int      // must(=), mustnot(!=), should(?)
+	multi        bool     // message,title=foo => filter:foo, multi: []string{"message","title"}
+}
+
+// Build a new  filter object. We use this to  build our elastic query
+// out of it. We support differnt types of queries:
+//
+//   - nop filter: no query at all, just return the first N documents.
+//
+//   - simple ones like: "authenticated", which match across all fields
+//
+//   - simple ones combined like "authenticated monitoring", if -O was set,
+//     apply an OR logic
+//
+//   - specific field queries: "message=authenticated" (can be combined too like above)
+//
+//   - and specific field queries with negation: "message!=authenticated"
+//
+// All queries support additional  filters using -F field=value, which
+// must match literally, and range filters using -r "@timestamp:2026-05-28T10:00:00 to now"
+func NewFilter(query string) (*filter, error) {
+	var separator string
+	var criteria int // we use the constants on top for this
+
+	switch {
+	case strings.Contains(query, "!="):
+		criteria = Fmustnot
+		separator = "!="
+	default:
+		criteria = Fmust
+		separator = "="
+	}
+
+	part := strings.Split(query, separator)
+	if len(part) != 2 {
+		return nil, fmt.Errorf("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
+	}
+
+	flt := &filter{term: part[0], filter: part[1], criteria: criteria}
+
+	if strings.Contains(part[0], ",") {
+		// a MultiMatchQuery, match across multiple fields at once
+		multi := strings.Split(part[0], ",")
+		flt.multi = true
+		flt.mterm = multi
+	}
+
+	return flt, nil
+}
+
+// Build a complex query set for queries containing field[!]=pattern
+func mkMatchQueries(queries []string, op operator.Operator) ([]types.QueryVariant, []types.QueryVariant, error) {
+	matchqueries := []types.QueryVariant{}
+	matchNotqueries := []types.QueryVariant{}
+
+	for _, q := range queries {
+		filter, err := NewFilter(q)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// by default we match on a single field
+		var match types.QueryVariant = esdsl.NewMatchQuery(filter.term, filter.filter)
+
+		if filter.multi {
+			// ok, match across multiple given fields
+			match = esdsl.NewMultiMatchQuery(filter.filter).Fields(filter.mterm...).Operator(op)
+		}
+
+		if filter.criteria == Fmustnot {
+			matchNotqueries = append(matchNotqueries, match)
+		} else {
+			matchqueries = append(matchqueries, match)
+		}
+	}
+
+	return matchqueries, matchNotqueries, nil
+}
+
+// Prepare user search query and turn it into a proper search request
+func prepareQuery(conf *cfg.Config, queries []string) (*types.Query, error) {
+	// logical operator for simple and multimatch queries
+	op := operator.Operator{Name: "AND"}
+	if conf.Or {
+		op = operator.Operator{Name: "OR"}
+	}
+
+	query := esdsl.NewBoolQuery()
+	wholeQuery := strings.Join(queries, " ")
+
+	switch {
+	case len(queries) == 0:
+		// nothing provided via ARGs, so match any docs
+		query.Must(esdsl.NewMatchAllQuery())
+
+	case !strings.ContainsAny(wholeQuery, "!="):
+		// simple query w/o any field[!]=pattern style
+		query.Must(esdsl.NewSimpleQueryStringQuery(wholeQuery).DefaultOperator(op))
+
+	default:
+		// a complex query
+		matchqueries, matchNotqueries, err := mkMatchQueries(queries, op)
+		if err != nil {
+			return nil, err
+		}
+
+		// apply boolean logic
+		if conf.Or {
+			query.Should(matchqueries...)
+		} else {
+			// by default we use AND
+			query.Must(matchqueries...)
+		}
+
+		if matchNotqueries != nil {
+			query.MustNot(matchNotqueries...)
+		}
+	}
+
+	slog.Debug("complex query", "query", query)
+
+	// there might be boolean or range filters like -Ffield=value as well
+	filters, err := addFilters(conf)
+	if err != nil {
+		return nil, err
+	}
+
+	if filters != nil {
+		query.Filter(filters...)
+	}
+
+	return query.QueryCaster(), nil
+}
+
+// Build a slice of filters, to be fed into query.Filter() including static ones
+// like -Ffield=value and ranges like -r "@timestamp:2026-05-28T10:00:00 to now"
+func addFilters(conf *cfg.Config) ([]types.QueryVariant, error) {
+	count := len(conf.Filter)
+	if conf.Range != "" {
+		count++
+	}
+
+	if count == 0 {
+		return nil, nil
+	}
+
+	filters := make([]types.QueryVariant, count)
+
+	// static filters
+	for idx, filter := range conf.Filter {
+		parts := strings.Split(filter, "=")
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid filter spec: %s, expecting key=value", filter)
+		}
+
+		filters[idx] = esdsl.NewTermQuery(parts[0], esdsl.NewFieldValue().String(parts[1]))
+	}
+
+	// range filters. format: @timestamp:2026-05-05 to 2026-05-15
+	// see: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+	if conf.Range != "" {
+		parts := strings.SplitN(conf.Range, ":", 2)
+		if len(parts) != 2 {
+			return nil, errors.New("invalid range format, expected field:range")
+		}
+
+		field := parts[0]
+
+		parts = strings.Split(parts[1], " to ")
+		if len(parts) != 2 {
+			return nil, errors.New("invalid date range format, expected '<start> to <end>'")
+		}
+
+		from := parts[0]
+		to := parts[1]
+
+		slog.Debug("time range filter",
+			"from", from,
+			"to", to,
+			"format", conf.TimestampFormat,
+			"count", count,
+		)
+
+		rng := esdsl.NewDateRangeQuery(field).
+			Gte(from).
+			Lte(to)
+
+		if strings.Contains(parts[1], ":") {
+			// specific format not needed as long as there are no times specified
+			rng.Format(conf.TimestampFormat)
+		}
+
+		filters[count-1] = rng
+
+	}
+
+	return filters, nil
+}
+
+// check if the conf.SortBy  field (default: @timestamp) is searchable
+// by using the field capabilities API.
+func addSort(conf *cfg.Config, search *search.Search) *search.Search {
+	res, err := conf.DefaultCluster.ES.FieldCaps().
+		Index(conf.Index).
+		Fields(conf.SortBy).
+		Do(context.Background())
+
+	if err != nil {
+		// whatever it was, do not add Sort()
+		slog.Debug("get field capabilities", "field", conf.SortBy, "error", esErrorString(err))
+
+		return search
+	}
+
+	field, exists := res.Fields[conf.SortBy]
+
+	if exists {
+		// good, the field exists
+		for _, cap := range field {
+			if cap.Searchable {
+				// ok, ES would be willing to sort by this field
+				order := esdsl.NewFieldSort(sortorder.Desc)
+				if conf.Ascending {
+					order = esdsl.NewFieldSort(sortorder.Asc)
+				}
+
+				search = search.Sort(
+					esdsl.NewSortOptions().AddSortOption(conf.SortBy, order),
+				)
+
+				break
+			}
+		}
+	}
+
+	return search
+}

pkg/es/shard.go

@@ -22,10 +22,11 @@ import (
 	"log/slog"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/shards"
 )
 
-func colorzizeShard(state, name string) string {
+func colorzizeShard(conf *cfg.Config, state, name string) string {
 	color := "red" // in case of RELOCATING and UNASSIGNED
 
 	switch state {
@@ -35,7 +36,7 @@ func colorzizeShard(state, name string) string {
 		color = "yellow"
 	}
 
-	return Colorize(color, name)
+	return printer.Colorize(conf, color, name)
 }
 
 func resolvePrirep(state string) string {
@@ -87,7 +88,7 @@ func ShardList(conf *cfg.Config) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", err)
+		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
 	}
 
 	shardlist := filterShards(conf, res)
@@ -102,13 +103,13 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 		headers = append(headers, "node", "ip")
 	}
 
-	table := NewTable(len(headers), len(shardlist))
+	table := printer.NewTable(conf, len(headers), len(shardlist))
 	table.Addheaders(headers...)
 
 	for idx, shard := range shardlist {
-		name := colorzizeShard(*shard.State, *shard.Index)
+		name := colorzizeShard(conf, *shard.State, *shard.Index)
 
-		table.entries[idx] = []string{
+		table.Entries[idx] = []string{
 			name,
 			*shard.Shard,
 			resolvePrirep(*shard.Prirep),
@@ -118,7 +119,7 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 		}
 
 		if conf.Verbose {
-			table.entries[idx] = append(table.entries[idx],
+			table.Entries[idx] = append(table.Entries[idx],
 				*shard.Node,
 				*shard.Ip,
 			)
@@ -126,7 +127,7 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -139,7 +140,7 @@ func ShardShow(conf *cfg.Config, index string) error {
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", err)
+		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "shards", res)

pkg/es/snapshot.go

@@ -25,6 +25,7 @@ import (
 	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
 )
 
 var (
@@ -44,7 +45,7 @@ func SnapshotList(conf *cfg.Config) error {
 	// get partial indicies
 	ires, err := conf.DefaultCluster.ES.Cat.Indices().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", err)
+		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
 	}
 
 	indicies := map[string]int{}
@@ -57,7 +58,7 @@ func SnapshotList(conf *cfg.Config) error {
 	// get snapshots
 	sres, err := conf.DefaultCluster.ES.Cat.Snapshots().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshots: %s", err)
+		return fmt.Errorf("failed to get snapshots: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "indicies", sres)
@@ -83,11 +84,11 @@ func SnapshotList(conf *cfg.Config) error {
 		}
 	}
 
-	table := NewTable(5, len(snapshots))
+	table := printer.NewTable(conf, 5, len(snapshots))
 	table.Addheaders("name", "index", "start", "orphaned", "status")
 
 	for idx, snap := range snapshots {
-		table.entries[idx] = []string{
+		table.Entries[idx] = []string{
 			snap.Name,
 			snap.Forindex,
 			snap.Start,
@@ -97,7 +98,7 @@ func SnapshotList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 
@@ -107,7 +108,7 @@ func SnapshotList(conf *cfg.Config) error {
 func SnapshotShow(conf *cfg.Config, snapshot string) error {
 	res, err := conf.DefaultCluster.ES.Snapshot.Get("*", snapshot).Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshot: %s", err)
+		return fmt.Errorf("failed to get snapshot: %s", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "snapshot", res)
@@ -116,12 +117,12 @@ func SnapshotShow(conf *cfg.Config, snapshot string) error {
 		return errors.New("no snapshot retrieved")
 	}
 
-	table := NewTable(2, 17)
+	table := printer.NewTable(conf, 2, 17)
 	table.Addheaders("snapshot property", "value")
 
 	snap := res.Snapshots[0]
 
-	table.entries = [][]string{
+	table.Entries = [][]string{
 		{"snapshot", snapshot},
 		{"uuid", snap.Uuid},
 		{"repository", *snap.Repository},
@@ -137,7 +138,7 @@ func SnapshotShow(conf *cfg.Config, snapshot string) error {
 		{"shards-successful", fmt.Sprintf("%d", snap.Shards.Successful)},
 	}
 
-	if err := table.PrintMarkdown(); err != nil {
+	if err := table.Print(); err != nil {
 		return err
 	}
 

pkg/es/table.go

@@ -1,114 +0,0 @@
-/*
-Copyright © 2026 Thomas von Dein
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-package es
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-
-	"github.com/olekukonko/tablewriter"
-	"github.com/olekukonko/tablewriter/renderer"
-	"github.com/olekukonko/tablewriter/tw"
-)
-
-type Table struct {
-	headers []string
-	entries [][]string
-}
-
-func NewTable(columns, rows int) *Table {
-	table := Table{}
-
-	table.headers = make([]string, columns)
-	table.entries = make([][]string, rows)
-
-	return &table
-}
-
-func (data *Table) PrintMarkdown() error {
-	tableString := &strings.Builder{}
-
-	table := tablewriter.NewTable(tableString,
-		tablewriter.WithRenderer(
-			renderer.NewBlueprint(
-				tw.Rendition{
-					Borders: tw.Border{
-						Left:   tw.On,
-						Right:  tw.On,
-						Top:    tw.Off,
-						Bottom: tw.Off,
-					},
-					Settings: tw.Settings{
-						Separators: tw.Separators{
-							ShowHeader:     tw.On,
-							ShowFooter:     tw.Off,
-							BetweenRows:    tw.Off,
-							BetweenColumns: 0,
-						},
-					},
-					Symbols: tw.NewSymbols(tw.StyleMarkdown),
-				})),
-
-		tablewriter.WithConfig(
-			tablewriter.Config{
-				Header: tw.CellConfig{
-					Formatting: tw.CellFormatting{
-						Alignment:  tw.AlignLeft,
-						AutoFormat: tw.Off,
-					},
-				},
-				Row: tw.CellConfig{
-					Formatting: tw.CellFormatting{
-						Alignment: tw.AlignLeft,
-					},
-				},
-			},
-		),
-	)
-
-	table.Header(data.headers)
-
-	if err := table.Bulk(data.entries); err != nil {
-		return fmt.Errorf("failed to add data to table renderer: %s", err)
-	}
-
-	if err := table.Render(); err != nil {
-		return fmt.Errorf("failed to render table: %s", err)
-	}
-
-	fmt.Println(tableString.String())
-
-	return nil
-}
-
-func (data *Table) Sort() {
-	// sanity checks
-	if len(data.entries) == 0 {
-		return
-	}
-
-	sort.Slice(data.entries, func(i, j int) bool {
-		return data.entries[i][0] < data.entries[j][0]
-	})
-}
-
-func (data *Table) Addheaders(headers ...string) {
-	for idx, header := range headers {
-		data.headers[idx] = bold(strings.ToUpper(header))
-	}
-}

pkg/printer/color.go

@@ -15,18 +15,27 @@ You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
 
-package es
+package printer
 
-import "github.com/fatih/color"
+import (
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/fatih/color"
+)
 
 var (
 	green  = color.New(color.BgGreen, color.FgHiWhite).SprintFunc()
+	yellow = color.New(color.BgYellow, color.FgHiWhite).SprintFunc()
 	orange = color.BgRGB(255, 128, 0).AddRGB(0, 0, 0).SprintFunc()
 	red    = color.New(color.BgRed, color.FgHiWhite).SprintFunc()
 	bold   = color.New(color.Bold).SprintFunc()
 )
 
-func Colorize(col, what string) string {
+func Colorize(conf *cfg.Config, col, what string) string {
+	switch conf.Output {
+	case "json", "yaml":
+		return what
+	}
+
 	switch col {
 	case "green":
 		what = green(what)
@@ -34,6 +43,8 @@ func Colorize(col, what string) string {
 		what = orange(what)
 	case "red":
 		what = red(what)
+	case "yellow":
+		what = yellow(what)
 	}
 
 	return what

pkg/printer/doc.go

@@ -0,0 +1,45 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package printer
+
+import (
+	"fmt"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/tidwall/gjson"
+)
+
+func PrintDoc(conf *cfg.Config, hit types.Hit) {
+	var score types.Float64
+	if hit.Score_ != nil {
+		score = *hit.Score_
+	}
+
+	docjson := fmt.Sprintf(`{"id":"%s", "score":%0.4f, "index":"%s", "source":%s}`,
+		*hit.Id_,
+		score,
+		hit.Index_,
+		hit.Source_)
+
+	if conf.Path != "" {
+		value := gjson.Get(docjson, conf.Path)
+		fmt.Println(value.String())
+	} else {
+		fmt.Println(docjson)
+	}
+}

pkg/printer/table.go

@@ -0,0 +1,306 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package printer
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/olekukonko/tablewriter"
+	"github.com/olekukonko/tablewriter/renderer"
+	"github.com/olekukonko/tablewriter/tw"
+	"gopkg.in/yaml.v3"
+)
+
+type Table struct {
+	Mode    string // table, markdown, json
+	Headers []string
+	Entries [][]string
+
+	lenHeaders []int
+}
+
+func NewTable(conf *cfg.Config, columns, rows int) *Table {
+	table := Table{Mode: conf.Output}
+
+	table.Headers = make([]string, columns)
+	table.Entries = make([][]string, rows)
+	table.lenHeaders = make([]int, columns)
+
+	return &table
+}
+
+func (data *Table) Print() error {
+	switch data.Mode {
+	case "markdown", "md":
+		return data.PrintMarkdown()
+	case "json":
+		return data.PrintJSON()
+	case "yaml":
+		return data.PrintYAML()
+	default:
+		return data.PrintTSV()
+	}
+}
+
+var (
+	ansiCtrlSeq = regexp.MustCompile(`\033.[0-9;]+m`)
+)
+
+// needed for json and yaml output
+func (data *Table) toMap() []map[string]string {
+	raw := make([]map[string]string, len(data.Entries))
+
+	for idx, entries := range data.Entries {
+		raw[idx] = make(map[string]string, len(data.Headers))
+		for eidx, entry := range entries {
+			raw[idx][data.Headers[eidx]] = entry
+		}
+	}
+
+	return raw
+}
+
+func (data *Table) PrintYAML() error {
+	raw := data.toMap()
+
+	body, err := yaml.Marshal(raw)
+	if err != nil {
+		return fmt.Errorf("failed to produce YAML output: %s", err)
+	}
+
+	fmt.Println(string(body))
+
+	return nil
+}
+
+func (data *Table) PrintJSON() error {
+	raw := data.toMap()
+
+	body, err := json.MarshalIndent(raw, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to produce JSON output: %s", err)
+	}
+
+	fmt.Println(string(body))
+
+	return nil
+}
+
+// Well.  tablewriter  should be  able to  print in  TSV mode,  but it
+// doesn't  work because  of  the various  ansic  color escapes  we're
+// using. Therefore we do it the hard way and use our own TSV printer.
+func (data *Table) PrintTSV() error {
+	// determine lenght's
+	for idx, head := range data.Headers {
+		data.lenHeaders[idx] = visibleLen(head)
+	}
+
+	for _, entries := range data.Entries {
+		for idx, entry := range entries {
+			length := visibleLen(entry)
+			if data.lenHeaders[idx] < length {
+				data.lenHeaders[idx] = length
+			}
+		}
+	}
+
+	// output
+	for idx, header := range data.Headers {
+		fmt.Print(header, strings.Repeat(" ", data.lenHeaders[idx]-visibleLen(header)))
+		if idx < len(data.Headers)-1 {
+			fmt.Print("  ")
+		}
+	}
+	fmt.Println()
+
+	for _, entries := range data.Entries {
+		for idx, entry := range entries {
+			length := visibleLen(entry)
+
+			if isInt(entry) {
+				// align right
+				fmt.Print(strings.Repeat(" ", data.lenHeaders[idx]-length), entry)
+			} else {
+				fmt.Print(entry, strings.Repeat(" ", data.lenHeaders[idx]-length))
+			}
+
+			if idx < len(data.Headers)-1 {
+				fmt.Print("  ")
+			}
+		}
+		fmt.Println()
+	}
+
+	return nil
+}
+
+func (data *Table) PrintTabularFail() error {
+	OFS := "  "
+
+	tableString := &strings.Builder{}
+
+	styleTSV := tw.NewSymbolCustom("space").WithColumn("\t")
+
+	table := tablewriter.NewTable(tableString,
+		tablewriter.WithRenderer(
+			renderer.NewBlueprint(tw.Rendition{
+				Borders: tw.BorderNone,
+				Symbols: styleTSV,
+				Settings: tw.Settings{
+					Separators: tw.SeparatorsNone,
+					Lines:      tw.LinesNone,
+				},
+			})),
+		tablewriter.WithConfig(tablewriter.Config{
+			Header: tw.CellConfig{
+				Formatting: tw.CellFormatting{
+					AutoFormat: tw.Off,
+				},
+				Padding: tw.CellPadding{Global: tw.Padding{Left: "", Right: OFS}},
+			},
+			Row: tw.CellConfig{
+				Formatting: tw.CellFormatting{
+					AutoWrap:  tw.WrapNone,
+					Alignment: tw.AlignLeft,
+				},
+				Padding: tw.CellPadding{Global: tw.Padding{Right: OFS}},
+			},
+
+			Debug: true,
+		}),
+	)
+
+	table.Header(data.Headers)
+
+	if err := table.Bulk(data.Entries); err != nil {
+		return fmt.Errorf("failed to add data to table renderer: %s", err)
+	}
+
+	if err := table.Render(); err != nil {
+		return fmt.Errorf("failed to render table: %s", err)
+	}
+
+	// we  need to trim  our output here, because  tablewriter appends
+	// excess whitespace to our rows.
+	cleanedString := &strings.Builder{}
+
+	for _, row := range strings.Split(strings.TrimSpace(tableString.String()), "\n") {
+		cleanedString.WriteString(strings.TrimSpace(row))
+		cleanedString.WriteString("\n")
+	}
+
+	fmt.Println(cleanedString.String())
+
+	return nil
+}
+
+func (data *Table) PrintMarkdown() error {
+	tableString := &strings.Builder{}
+
+	table := tablewriter.NewTable(tableString,
+		tablewriter.WithRenderer(
+			renderer.NewBlueprint(
+				tw.Rendition{
+					Borders: tw.Border{
+						Left:   tw.On,
+						Right:  tw.On,
+						Top:    tw.Off,
+						Bottom: tw.Off,
+					},
+					Settings: tw.Settings{
+						Separators: tw.Separators{
+							ShowHeader:     tw.On,
+							ShowFooter:     tw.Off,
+							BetweenRows:    tw.Off,
+							BetweenColumns: 0,
+						},
+					},
+					Symbols: tw.NewSymbols(tw.StyleMarkdown),
+				})),
+
+		tablewriter.WithConfig(
+			tablewriter.Config{
+				Header: tw.CellConfig{
+					Formatting: tw.CellFormatting{
+						Alignment:  tw.AlignLeft,
+						AutoFormat: tw.Off,
+					},
+				},
+				Row: tw.CellConfig{
+					Formatting: tw.CellFormatting{
+						Alignment: tw.AlignLeft,
+					},
+				},
+			},
+		),
+	)
+
+	table.Header(data.Headers)
+
+	if err := table.Bulk(data.Entries); err != nil {
+		return fmt.Errorf("failed to add data to table renderer: %s", err)
+	}
+
+	if err := table.Render(); err != nil {
+		return fmt.Errorf("failed to render table: %s", err)
+	}
+
+	fmt.Println(tableString.String())
+
+	return nil
+}
+
+func (data *Table) Sort() {
+	// sanity checks
+	if len(data.Entries) == 0 {
+		return
+	}
+
+	sort.Slice(data.Entries, func(i, j int) bool {
+		return data.Entries[i][0] < data.Entries[j][0]
+	})
+}
+
+func (data *Table) Addheaders(headers ...string) {
+	for idx, header := range headers {
+		switch data.Mode {
+		case "json", "yaml":
+			data.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
+		default:
+			data.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
+		}
+	}
+}
+
+// return the length of a string but only visible chars, w/o ansi color escapes
+func visibleLen(word string) int {
+	return len(ansiCtrlSeq.ReplaceAllLiteralString(word, ""))
+}
+
+func isInt(num string) bool {
+	if _, err := strconv.Atoi(num); err == nil {
+		return true
+	}
+
+	return false
+}