fix doc add id creation, use rand.Int64()

README.md

@@ -6,7 +6,7 @@ Elasticsearch CLI
 
 ## Usage
 
-Command tree
+Command tree:
 
 ```console
  ccr
@@ -34,6 +34,7 @@ Command tree
  index
      alias
          create
+         delete
          list
      allocation
      close
@@ -53,6 +54,7 @@ Command tree
  snapshot
      list
      show
+ version
 ```
 
 Configure `esctl` with environment variables:

cmd/doc.go

@@ -33,7 +33,8 @@ func Doc(conf *cfg.Config) *cli.Command {
 
 		Commands: []*cli.Command{
 			DocAdd(conf),
-			//Delete(conf),
+			DocShow(conf),
+			DocDelete(conf),
 		},
 	}
 }
@@ -43,16 +44,134 @@ func DocAdd(conf *cfg.Config) *cli.Command {
 		Name:      "add",
 		Aliases:   []string{"+"},
 		Usage:     "add JSON document index",
-		UsageText: "add [options] <index> '<json-doc>'",
+		UsageText: "add [options] -i <index> '<json-doc>'",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 
-			if args.Len() != 2 {
+			if args.Len() != 1 {
-				return errors.New("missing arguments: <index> <json-doc>")
+				return errors.New("missing arguments: <json-doc>")
 			}
 
-			return es.DocAdd(conf, cmd.Args().Get(0), cmd.Args().Get(1))
+			return es.DocAdd(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func DocShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "show",
+		Aliases:   []string{"sh"},
+		Usage:     "show a JSON document",
+		UsageText: "show [options] -i <index> <id>",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+			&cli.StringFlag{
+				Name:        "path",
+				Usage:       "jsonPath filter (e.g. source.message)",
+				Destination: &conf.Path,
+				Aliases:     []string{"p"},
+			},
+			&cli.BoolFlag{
+				Name:        "help-jsonpath",
+				Usage:       "show jsonPath help",
+				Destination: &conf.Subhelp,
+				Aliases:     []string{"H"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
+			args := cmd.Args()
+
+			if args.Len() != 1 {
+				return errors.New("missing arguments: <id>")
+			}
+
+			return es.DocShow(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func DocDelete(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "delete",
+		Aliases:   []string{"rm"},
+		Usage:     "delete JSON document[s] from index[es]",
+		UsageText: "delete [options] -i <index> [<[field<sep>]pattern> ...]\n" + SearchUsage,
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "all",
+				Usage:       "delete all docs (dangerous!)",
+				Destination: &conf.All,
+				Aliases:     []string{"a"},
+			},
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to work on",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+			&cli.StringSliceFlag{
+				Name:        "filter",
+				Usage:       "additional boolean filters. format: key=value",
+				Destination: &conf.Filter,
+				Aliases:     []string{"F"},
+			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
+			args := cmd.Args()
+
+			if args.Len() == 0 && !conf.All {
+				return errors.New("missing arguments: <query>")
+			}
+
+			return es.DocDelete(conf, cmd.Args().Slice())
 		},
 	}
 }

cmd/index_alias.go

@@ -35,8 +35,8 @@ func IndexAlias(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			IndexAliasCreate(conf),
 			IndexAliasList(conf),
+			IndexAliasDelete(conf),
 			//IndexAliasShow(conf),
-			//IndexAliasDelete(conf),
 			//IndexAliasAdd(conf), // see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
 		},
 	}
@@ -62,6 +62,26 @@ func IndexAliasCreate(conf *cfg.Config) *cli.Command {
 	}
 }
 
+func IndexAliasDelete(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "delete",
+		Aliases:   []string{"rm"},
+		Usage:     "delete an index alias",
+		UsageText: "delete <index> <alias>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			alias := cmd.Args().Get(1)
+
+			if index == "" || alias == "" {
+				return errors.New("no index or alias specified")
+			}
+
+			return es.IndexAliasDelete(conf, index, alias)
+		},
+	}
+}
+
 func IndexAliasList(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:    "list",

cmd/root.go

@@ -22,6 +22,7 @@ import (
 	"os"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
 
 	"github.com/urfave/cli/v3"
@@ -54,6 +55,12 @@ func Main() int {
 				Sources:     cli.EnvVars("ES_DEBUG"),
 				Destination: &conf.Debug,
 			},
+			&cli.BoolFlag{
+				Name:        "debug-http",
+				Value:       false,
+				Usage:       "enable HTTP debugging",
+				Destination: &conf.DebugHTTP,
+			},
 			&cli.StringFlag{
 				Name:        "config",
 				Aliases:     []string{"c"},
@@ -89,6 +96,7 @@ func Main() int {
 			Doc(conf),
 			Repl(conf),
 			Version(conf),
+			Debug(conf),
 		},
 
 		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
@@ -122,3 +130,24 @@ func Version(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func Debug(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "debug",
+		Usage: "developer only",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "index",
+				Usage:       "index to search within",
+				Sources:     cli.EnvVars("ES_INDEX"),
+				Destination: &conf.Index,
+				Aliases:     []string{"i"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.Debug(conf)
+		},
+	}
+}

cmd/search.go

@@ -18,7 +18,7 @@ package cmd
 
 import (
 	"context"
-	"errors"
+	"fmt"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -26,12 +26,33 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
+const SearchUsage = `<sep> might be one of:
+ =: Must match
+!=: Must not match
+
+You can omit a field spec and thereby search across all fields.
+
+By default all queries contribute to matches (logical AND), use
+-O to apply a logical OR operator.
+
+You can also search multiple fields by separating them with comma, eg:
+user,group=root
+
+Use filters to further restrict results, they must match literally.
+
+For datetime range format refer to:
+https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+
+For timestamp formats refer to:
+https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format
+`
+
 func Search(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "search",
 		Aliases:   []string{"/"},
 		Usage:     "search within an index",
-		UsageText: "search [options] <field=pattern> ...",
+		UsageText: "search [options] [<[field<sep>]pattern> ...]\n" + SearchUsage,
 
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -43,33 +64,105 @@ func Search(conf *cfg.Config) *cli.Command {
 			},
 			&cli.IntFlag{
 				Name:        "from",
-				Usage:       "show results FROM (default 0)",
+				Usage:       "show results starting at <from>",
 				Destination: &conf.From,
 				Value:       0,
 				Aliases:     []string{"f"},
 			},
 			&cli.IntFlag{
-				Name:        "to",
+				Name:        "len",
-				Usage:       "show results to (default 10)",
+				Usage:       "number of results to show (-1: all[max:10k], caution: might be slow)",
 				Destination: &conf.To,
-				Value:       10,
+				Value:       20,
-				Aliases:     []string{"t"},
+				Aliases:     []string{"l"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
-				Usage:       "additional filters. format: key=value",
+				Usage:       "additional boolean filters. format: key=value",
 				Destination: &conf.Filter,
 				Aliases:     []string{"F"},
 			},
+			&cli.StringFlag{
+				Name:        "jsonpath",
+				Usage:       "jsonPath filter (e.g. source.message)",
+				Destination: &conf.Path,
+				Aliases:     []string{"p"},
+			},
+			&cli.StringFlag{
+				Name:        "timerange",
+				Usage:       "field:<date> to <date> (e.g. @timestamp:2026-05-05 to 2026-05-15)",
+				Destination: &conf.Range,
+				Aliases:     []string{"r"},
+			},
+			&cli.StringFlag{
+				Name:        "timestamp-format",
+				Usage:       "a valid ES builtin timestamp or custom format",
+				Destination: &conf.TimestampFormat,
+				Value:       "strict_date_hour_minute",
+			},
+			&cli.BoolFlag{
+				Name:        "help-jsonpath",
+				Usage:       "show jsonPath help",
+				Destination: &conf.Subhelp,
+				Aliases:     []string{"H"},
+			},
+			&cli.BoolFlag{
+				Name:        "tail",
+				Usage:       "follow search live, like tail -f",
+				Destination: &conf.Tail,
+				Aliases:     []string{"T"},
+			},
+			&cli.BoolFlag{
+				Name:        "or",
+				Usage:       "logical operator (default: and)",
+				Destination: &conf.Or,
+				Aliases:     []string{"O"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
+			if conf.Subhelp {
+				return showJsonPathHelp()
+			}
+
 			args := cmd.Args()
-			if args.Len() == 0 {
+
-				return errors.New("at least one query must be specified (format: field=pattern)")
+			if conf.To == -1 {
+				conf.To = 10000
 			}
 
 			return es.Search(conf, args.Slice())
 		},
 	}
 }
+
+func showJsonPathHelp() error {
+	_, err := fmt.Println(`jsonPath usage:
+
+name.last          >> "Anderson"
+age                >> 37
+children           >> ["Sara","Alex","Jack"]
+children.#         >> 3
+children.1         >> "Alex"
+child*.2           >> "Jack"
+c?ildren.0         >> "Sara"
+fav\.movie         >> "Deer Hunter"
+friends.#.first    >> ["Dale","Roger","Jane"]
+friends.1.last     >> "Craig"
+
+You can also  query an array for  the first match by  using #(...), or
+find all matches  with #(...)#. Queries support the ==,  !=, <, <=, >,
+>= comparison operators  and the simple pattern matching  % (like) and
+!% (not like) operators. Eg:
+
+friends.#(last=="Murphy").first    >> "Dale"
+friends.#(last=="Murphy")#.first   >> ["Dale","Jane"]
+friends.#(age>45)#.last            >> ["Craig","Murphy"]
+friends.#(first%"D*").last         >> "Murphy"
+friends.#(first!%"D*").last        >> "Craig"
+friends.#(nets.#(=="fb"))#.first   >> ["Dale","Roger"]
+
+Documentation: https://github.com/tidwall/gjson/blob/master/SYNTAX.md`)
+
+	return err
+}

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/mattn/go-isatty v0.0.22
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/tlinden/yadu v0.1.3
-	github.com/urfave/cli/v3 v3.9.0
+	github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -43,6 +43,9 @@ require (
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.8 // indirect
+	github.com/tidwall/gjson v1.19.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel v1.35.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect

go.sum

@@ -58,12 +58,20 @@ github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
 github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
 github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
 github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tlinden/yadu v0.1.3 h1:5cRCUmj+l5yvlM2irtpFBIJwVV2DPEgYSaWvF19FtcY=
 github.com/tlinden/yadu v0.1.3/go.mod h1:l3bRmHKL9zGAR6pnBHY2HRPxBecf7L74BoBgOOpTcUA=
 github.com/urfave/cli/v3 v3.8.0 h1:XqKPrm0q4P0q5JpoclYoCAv0/MIvH/jZ2umzuf8pNTI=
 github.com/urfave/cli/v3 v3.8.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=
 github.com/urfave/cli/v3 v3.9.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de h1:ESKPiS7inVoBnv4FmgGNZdjWBI/wmvaragoyD3D9nM4=
+github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=

pkg/cfg/config.go

@@ -17,10 +17,13 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package cfg
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 
@@ -31,10 +34,11 @@ import (
 )
 
 const (
-	Version string = `v0.0.12`
+	Version string = `v0.0.14`
 )
 
 var (
+	// initialized during build, see Makefile:buildlocal
 	APIVERSION, GOVERSION, BUILD, COMMIT, BRANCH string
 )
 
@@ -57,11 +61,18 @@ type Config struct {
 	Primary                        bool     // index allocation: -p
 	From, To, MaxItems             int      // search: flags
 	Filter                         []string // search: -F
+	Path                           string   // search+doc sh: -p
+	Subhelp                        bool     // search+doc sh: -H
+	Tail                           bool     // search: -f [tail]
+	Or                             bool     // search: -O
+	Range                          string   // search: -r
+	TimestampFormat                string   // search: --timestamp-format
 	Exclude                        string   // cluster compare: -e (regexp)
 	All, Verbose                   bool     // cluster status: -a -v
 	Persistent, Transient, Default bool     // -p -t -D cluster settings set
 	Force                          bool     // ccr follower renew: -f
 	HaveJQ                         bool     // determined at runtime by ourselfes
+	DebugHTTP                      bool     // root: --debug-http
 }
 
 func NewConfig() *Config {
@@ -197,18 +208,26 @@ func (conf *Config) LoadConfig() error {
 	return nil
 }
 
+func (conf *Config) getTransport() elastictransport.Option {
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+
+	if conf.DebugHTTP {
+		return elastictransport.WithTransport(
+			&DebugTransport{Transport: transport},
+		)
+	}
+
+	return elastictransport.WithTransport(transport)
+}
+
 func (conf *Config) SetupES() error {
 	for _, cluster := range conf.Clusters {
 		es, err := elasticsearch.NewTyped(
 			elasticsearch.WithAddresses(cluster.Uri),
 			elasticsearch.WithBasicAuth(cluster.User, cluster.Pass),
-			elasticsearch.WithTransportOptions(
+			elasticsearch.WithTransportOptions(conf.getTransport()),
-				elastictransport.WithTransport(
-					&http.Transport{
-						TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-					},
-				),
-			),
 		)
 
 		if err != nil {
@@ -221,6 +240,39 @@ func (conf *Config) SetupES() error {
 	return nil
 }
 
+// used to print uri, path and body of a request made by the go-client
+type DebugTransport struct {
+	Transport http.RoundTripper
+}
+
+func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	content := ""
+	contentline := ""
+
+	if req.ContentLength > 0 {
+		buf := new(bytes.Buffer)
+		body, _ := req.GetBody()
+
+		_, err := buf.ReadFrom(body)
+		if err != nil {
+			return nil, err
+		}
+
+		var pretty bytes.Buffer
+		err = json.Indent(&pretty, buf.Bytes(), "", "\t")
+		if err != nil {
+			return nil, fmt.Errorf("json parse error: %s", err)
+		}
+
+		content = pretty.String()
+		contentline = buf.String()
+	}
+
+	slog.Info("req", "host", req.URL.Host, "uri", req.URL.Path, "body", content, "bodyline", contentline)
+
+	return t.Transport.RoundTrip(req)
+}
+
 func fileExists(filename string) bool {
 	info, err := os.Stat(filename)
 

pkg/es/cluster.go

@@ -163,11 +163,12 @@ func ClusterStatus(conf *cfg.Config) error {
 			)
 		}
 
-		table := printer.NewTable(conf, 2, 5)
+		table := printer.NewTable(conf, 2, 7)
 		table.Addheaders(cluster, "status")
 
 		table.Entries = [][]string{
-			{"Cluster Name", printer.Colorize(conf, clusterhealth.Status.Name, clusterhealth.ClusterName)},
+			{"Cluster Name", clusterhealth.ClusterName},
+			{"ES Status", printer.Colorize(conf, clusterhealth.Status.Name, clusterhealth.Status.Name)},
 			{"ES Version", info.Version.Int},
 			{"Active Shards", fmt.Sprintf("%d", clusterhealth.ActiveShards)},
 			{"Active Primary Shards", fmt.Sprintf("%d", clusterhealth.ActivePrimaryShards)},

pkg/es/cluster_util.go

@@ -25,7 +25,7 @@ import (
 	"sync"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
-    "codeberg.org/scip/esctl/pkg/printer"
+	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/elastic/go-elasticsearch/v9"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
@@ -75,14 +75,15 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 		status[cluster] = st
 	}
 
-	table := printer.NewTable(conf, 3, 5)
+	table := printer.NewTable(conf, 3, 6)
 
 	table.Addheaders("setting", "leader:"+leader, "follower:"+follower)
 
 	table.Entries = [][]string{
-		{"Cluster Name",
+		{"Cluster Name", status[leader].ClusterName, status[follower].ClusterName},
-			printer.Colorize(conf, status[leader].Status.Name, status[leader].ClusterName),
+		{"Cluster Status",
-			printer.Colorize(conf, status[follower].Status.Name, status[follower].ClusterName),
+			printer.Colorize(conf, status[leader].Status.Name, status[leader].Status.Name),
+			printer.Colorize(conf, status[follower].Status.Name, status[follower].Status.Name),
 		},
 		{"Active Shards",
 			fmt.Sprintf("%d", status[leader].ActiveShards),
@@ -107,6 +108,8 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 		return false
 	}
 
+	fmt.Println()
+
 	if status[leader].Status.Name == "green" && status[follower].Status.Name == "green" {
 		return true
 	}

pkg/es/doc.go

@@ -19,10 +19,15 @@ package es
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"time"
+	"math/rand/v2"
+	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/core/deletebyquery"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
+	"github.com/tidwall/gjson"
 )
 
 // create index with:
@@ -32,7 +37,7 @@ import (
 // then add a doc:
 //
 // esctl doc add foo2 '{"id":"d8d8d","user":"scip"}'
-func DocAdd(conf *cfg.Config, index, jsondoc string) error {
+func DocAdd(conf *cfg.Config, jsondoc string) error {
 	data := map[string]any{}
 
 	err := json.Unmarshal([]byte(jsondoc), &data)
@@ -40,15 +45,87 @@ func DocAdd(conf *cfg.Config, index, jsondoc string) error {
 		return fmt.Errorf("supplied document was not valid JSON: %s", err)
 	}
 
-	now := fmt.Sprintf("%d", time.Now().Unix())
+	now := fmt.Sprintf("%d", rand.Int64())
 
-	_, err = conf.DefaultCluster.ES.Create(index, now).
+	res, err := conf.DefaultCluster.ES.Create(conf.Index, now).
 		Document(data).
 		Header("content-type", "application/json").
 		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to create new doc in index %s: %s", index, err)
+		return fmt.Errorf("failed to create new doc in index %s: %s", conf.Index, err)
+	}
+
+	fmt.Println(res.Id_)
+
+	return nil
+}
+
+func DocShow(conf *cfg.Config, id string) error {
+	res, err := conf.DefaultCluster.ES.Get(conf.Index, id).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to retrieve doc in index %s: %s", conf.Index, err)
+	}
+
+	if !res.Found {
+		return errors.New("no document with that id found")
+	}
+
+	docjson := fmt.Sprintf(`{"id":%s, "index":"%s", "source":%s}`,
+		res.Id_,
+		res.Index_,
+		res.Source_)
+
+	if conf.Path != "" {
+		value := gjson.Get(docjson, conf.Path)
+		fmt.Println(value.String())
+	} else {
+		fmt.Println(docjson)
+	}
+
+	fmt.Println()
+
+	return nil
+}
+
+func DocDelete(conf *cfg.Config, queries []string) error {
+	if len(queries) == 1 && strings.Contains(queries[0], "id=") {
+		id, _ := strings.CutPrefix(queries[0], "id=")
+
+		_, err := conf.DefaultCluster.ES.Delete(conf.Index, id).
+			Header("content-type", "application/json").
+			Header("accept", "application/json").
+			Do(context.Background())
+		if err != nil {
+			return fmt.Errorf("failed to delete doc in index %s: %s", conf.Index, err)
+		}
+
+		return nil
+	}
+
+	req := &deletebyquery.Request{}
+
+	if len(queries) == 0 && conf.All {
+		req.Query = esdsl.NewMatchAllQuery().QueryCaster()
+	} else {
+		queryCaster, err := prepareQuery(conf, queries)
+		if err != nil {
+			return err
+		}
+
+		req.Query = queryCaster
+	}
+
+	_, err := conf.DefaultCluster.ES.DeleteByQuery(conf.Index).
+		Request(req).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to delete docs in index %s: %s", conf.Index, err)
 	}
 
 	return nil

pkg/es/index.go

@@ -129,6 +129,13 @@ func IndexShow(conf *cfg.Config, index string) error {
 
 	slog.Debug("ES result", "index", res)
 
+	fields := make([]string, len(res[index].Mappings.Properties))
+	idx := 0
+	for field := range res[index].Mappings.Properties {
+		fields[idx] = field
+		idx++
+	}
+
 	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("index property", "value")
 
@@ -145,6 +152,7 @@ func IndexShow(conf *cfg.Config, index string) error {
 		{"shards", *res[index].Settings.Index.NumberOfShards},
 		{"created", created.Format("2006-01-02 15:04:05")},
 		{"uuid", *res[index].Settings.Index.Uuid},
+		{"fields", strings.Join(fields, ",")},
 	}
 
 	if err := table.Print(); err != nil {

pkg/es/index_alias.go

@@ -24,16 +24,15 @@ import (
 	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
-    "codeberg.org/scip/esctl/pkg/printer"
+	"codeberg.org/scip/esctl/pkg/printer"
 )
 
 // FIXME: add filter support, see IndexCreate mapping
 func IndexAliasCreate(conf *cfg.Config, index, alias string) error {
-	create := conf.DefaultCluster.ES.Indices.PutAlias(index, alias).
+	res, err := conf.DefaultCluster.ES.Indices.PutAlias(index, alias).
 		Header("content-type", "application/json").
-		Header("accept", "application/json")
+		Header("accept", "application/json").
-
+		Do(context.Background())
-	res, err := create.Do(context.Background())
 
 	slog.Debug("create alias", "result", res)
 
@@ -52,12 +51,11 @@ func IndexAliasList(conf *cfg.Config) error {
 		filter = *regexp.MustCompile(conf.Filter[0])
 	}
 
-	create := conf.DefaultCluster.ES.Indices.GetAlias().
+	res, err := conf.DefaultCluster.ES.Indices.GetAlias().
 		Index("_all").
 		Header("content-type", "application/json").
-		Header("accept", "application/json")
+		Header("accept", "application/json").
-
+		Do(context.Background())
-	res, err := create.Do(context.Background())
 
 	if err != nil {
 		return fmt.Errorf("failed to list index aliases: %s", err)
@@ -100,3 +98,18 @@ func IndexAliasList(conf *cfg.Config) error {
 
 	return nil
 }
+
+func IndexAliasDelete(conf *cfg.Config, index, alias string) error {
+	res, err := conf.DefaultCluster.ES.Indices.DeleteAlias(index, alias).
+		Header("content-type", "application/json").
+		Header("accept", "application/json").
+		Do(context.Background())
+
+	slog.Debug("delete alias", "result", res)
+
+	if err != nil {
+		return fmt.Errorf("failed to delete index alias: %s", err)
+	}
+
+	return nil
+}

pkg/es/repl.go

@@ -17,6 +17,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package es
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"crypto/tls"
@@ -34,19 +35,98 @@ import (
 	"github.com/chzyer/readline"
 )
 
+const intro = `Input format: verb path [data]"
+
+Example:
+
+post /yourindex/_ccr/pause_follow
+put /yourindex/_settings {"number_of_replicas": 1}
+
+You can also put multiline JSON after the path like:
+
+put /yourindex/_settings
+{
+  "number_of_replicas": 1
+}
+
+If you do NOT  supply a JSON in the first line, you  need to hit ENTER
+twice to complete.`
+
+func Repl(conf *cfg.Config) error {
+	verbs := []string{"post", "get", "put", "delete"}
+
+	fmt.Println(intro)
+	fmt.Println()
+
+	reader, err := readline.NewEx(&readline.Config{
+		Prompt:            "> ",
+		HistoryFile:       os.Getenv("HOME") + "/.config/esctl/history",
+		HistoryLimit:      500,
+		InterruptPrompt:   "^C",
+		EOFPrompt:         "exit",
+		HistorySearchFold: true,
+	})
+
+	if err != nil {
+		return fmt.Errorf("failed to initialize readline lib: %s", err)
+	}
+
+	for {
+		text, err := reader.Readline()
+		if err != nil {
+			break
+		}
+
+		text = strings.TrimSpace(text)
+
+		if text == "" {
+			continue
+		}
+
+		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
+		if len(parts) < 2 {
+			fmt.Println("error: you need to input a verb, uri [and post data]")
+			continue
+		}
+
+		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
+			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
+			continue
+		}
+
+		if !strings.HasPrefix(parts[1], "/") {
+			parts[1] = "/" + parts[1]
+		}
+
+		json := ""
+		if len(parts) == 3 {
+			// put /uri {json}
+			json = parts[2]
+		}
+
+		// put /uri/<Ret> [json]
+		data, err := readJSON(json)
+		if err != nil {
+			fmt.Println(err)
+		}
+
+		err = CallAPI(conf, parts[0], parts[1], data)
+		if err != nil {
+			fmt.Printf("failed to call API: %s\n", err)
+		}
+
+		reader.SetPrompt("> ")
+	}
+
+	return nil
+}
+
 func encodeAuth(username, password string) string {
 	return base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
 }
 
-func CallAPI(conf *cfg.Config, input []string) error {
+func CallAPI(conf *cfg.Config, verb, path, data string) error {
-	var data string
+	verb = strings.ToUpper(verb)
-
-	verb := strings.ToUpper(input[0])
-	path := input[1]
-
-	if len(input) == 3 {
-		data = input[2]
-	}
 
 	// we're using port-forwards anyway
 	tr := &http.Transport{
@@ -108,69 +188,37 @@ func prettyfiJson(conf *cfg.Config, raw []byte) error {
 	return nil
 }
 
-func Repl(conf *cfg.Config) error {
+// interactively  read  arbitrary  JSON  data  from  STDIN,  which  is
-	verbs := []string{"post", "get", "put", "delete"}
+// virtually a repl inside the primary repl
+func readJSON(input string) (string, error) {
+	data := ""
 
-	fmt.Println("Input format: verb path [data]")
+	if input != "" {
-	fmt.Println("example: post /yourindex/_ccr/pause_follow")
+		data = input
+	} else {
+		scanner := bufio.NewScanner(os.Stdin)
+		for scanner.Scan() {
+			line := strings.TrimSpace(scanner.Text())
 
-	reader, err := readline.NewEx(&readline.Config{
+			if line == "" {
-		Prompt:            "> ",
+				break
-		HistoryFile:       os.Getenv("HOME") + "/.config/esctl/history",
-		HistoryLimit:      500,
-		InterruptPrompt:   "^C",
-		EOFPrompt:         "exit",
-		HistorySearchFold: true,
-	})
-
-	if err != nil {
-		return fmt.Errorf("failed to initialize readline lib: %s", err)
-	}
-
-	for {
-		text, err := reader.Readline()
-		if err != nil {
-			break
-		}
-
-		text = strings.TrimSpace(text)
-
-		if text == "" {
-			continue
-		}
-
-		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
-		if len(parts) < 2 {
-			fmt.Println("error: you need to input a verb, uri [and post data]")
-			continue
-		}
-
-		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
-			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
-			continue
-		}
-
-		if !strings.HasPrefix(parts[1], "/") {
-			fmt.Println("error: url path must start with /")
-			continue
-		}
-
-		if len(parts) == 3 {
-			data := map[string]any{}
-			err := json.Unmarshal([]byte(parts[2]), &data)
-			if err != nil {
-				fmt.Printf("error: input data is not proper JSON: %s", err)
-				continue
 			}
-		}
 
-		err = CallAPI(conf, parts)
+			data += line
-		if err != nil {
-			fmt.Printf("failed to call API: %s\n", err)
 		}
-
-		reader.SetPrompt("> ")
 	}
 
-	return nil
+	if data == "" {
+		return data, nil
+	}
+
+	// validate
+	check := map[string]any{}
+	err := json.Unmarshal([]byte(data), &check)
+	if err != nil {
+		return "", fmt.Errorf("error: input data is not proper JSON: %s", err)
+
+	}
+
+	return data, nil
 }

pkg/es/search.go

@@ -19,13 +19,22 @@ package es
 import (
 	"context"
 	"fmt"
+	"log"
 	"log/slog"
 	"strings"
+	"time"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/alecthomas/repr"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/core/search"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/sortorder"
+)
+
+const (
+	MAXPAGE = 5000
 )
 
 /*
@@ -35,49 +44,155 @@ Execute an ES search.
 	additional filters can be given as -F key=value
 */
 func Search(conf *cfg.Config, queries []string) error {
-	query := esdsl.NewBoolQuery()
+	searchEs := conf.DefaultCluster.ES.Search().
+		Index(conf.Index)
 
-	for _, q := range queries {
+	queryCaster, err := prepareQuery(conf, queries)
-		parts := strings.Split(q, "=")
+	if err != nil {
-		if len(parts) != 2 {
+		return err
-			return fmt.Errorf("search queries must be in the form field=pattern")
+	}
+
+	req := &search.Request{Query: queryCaster}
+
+	searchEs.Request(req)
+
+	switch conf.Tail {
+	case true:
+		return searchTail(conf, searchEs)
+	case false:
+		if conf.To > MAXPAGE {
+			return searchPit(conf, req)
+		} else {
+			return searchOnce(conf, searchEs)
 		}
-
-		query.Must(esdsl.NewMatchQuery(parts[0], parts[1]))
 	}
 
-	filters := make([]types.QueryVariant, len(conf.Filter))
+	return nil
-
+}
-	for idx, filter := range conf.Filter {
-		parts := strings.Split(filter, "=")
-		if len(parts) != 2 {
-			return fmt.Errorf("invalid filter spec: %s, expecting key=value", filter)
-		}
-
-		filters[idx] = esdsl.NewTermQuery(parts[0], esdsl.NewFieldValue().String(parts[1]))
-	}
-
-	if len(filters) > 0 {
-		query.Filter(filters...)
-	}
 
+func Debug(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES.Search().
 		Index(conf.Index).
-		Request(&search.Request{
+		Size(0).
-			Query: query.QueryCaster(),
+		Aggregations(map[string]types.Aggregations{
-			From:  &conf.From,
+			"min_ts": *esdsl.NewMinAggregation().Field("@timestamp").AggregationsCaster(),
-			Size:  &conf.To,
+			"max_ts": *esdsl.NewMaxAggregation().Field("@timestamp").AggregationsCaster(),
 		}).
 		Do(context.Background())
+
 	if err != nil {
+		return err
+	}
+
+	repr.Println(res)
+
+	return nil
+}
+
+func searchOnce(conf *cfg.Config, search *search.Search) error {
+	res, err := search.
+		From(conf.From).
+		Size(conf.To).
+		Do(context.Background())
+	if err != nil {
+		if strings.Contains(err.Error(), "reason: all shards failed") {
+			return nil
+		}
+
 		return fmt.Errorf("failed to run search (esdsl): %s", err)
 	}
 
 	slog.Debug("ES result", "search", res)
 
 	for _, hit := range res.Hits.Hits {
-		fmt.Printf("%s\n", hit.Source_)
+		printer.PrintDoc(conf, hit)
 	}
 
 	return nil
 }
+
+// https://www.elastic.co/docs/reference/elasticsearch/clients/go/using-the-api/searching#_pit_search_after
+func searchPit(conf *cfg.Config, req *search.Request) error {
+	ctx := context.Background()
+	pit, err := conf.DefaultCluster.ES.OpenPointInTime(conf.Index).KeepAlive("1m").Do(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to open point-in-time request for search: %s", err)
+	}
+	defer func() {
+		_, err := conf.DefaultCluster.ES.ClosePointInTime().Id(pit.Id).Do(ctx)
+		if err != nil {
+			log.Fatalf("failed to close PIT: %s", err)
+		}
+	}()
+
+	search := conf.DefaultCluster.ES.Search().
+		Request(req).
+		Pit(esdsl.NewPointInTimeReference().
+			Id(pit.Id).
+			KeepAlive(esdsl.NewDuration().String("1m"))).
+		Sort(esdsl.NewSortOptions().
+			AddSortOption("_shard_doc", esdsl.NewFieldSort(sortorder.Asc))).
+		Size(conf.To)
+
+	for {
+		res, err := search.Do(ctx)
+		if err != nil {
+			if strings.Contains(err.Error(), "reason: all shards failed") {
+				return nil
+			}
+
+			return fmt.Errorf("failed to run search (esdsl pit): %s", err)
+		}
+
+		if len(res.Hits.Hits) == 0 {
+			break
+		}
+
+		for _, hit := range res.Hits.Hits {
+			printer.PrintDoc(conf, hit)
+		}
+
+		last := res.Hits.Hits[len(res.Hits.Hits)-1]
+		search = search.SearchAfterValues(last.Sort)
+
+		if res.PitId != nil {
+			search = search.Pit(esdsl.NewPointInTimeReference().
+				Id(*res.PitId).
+				KeepAlive(esdsl.NewDuration().String("1m")))
+		}
+	}
+
+	return nil
+}
+
+func searchTail(conf *cfg.Config, search *search.Search) error {
+	docs := map[string]int{}
+
+	fmt.Println("enter ctrl-c to abort...")
+
+	for {
+		res, err := search.Do(context.Background())
+		if err != nil {
+			if strings.Contains(err.Error(), "reason: all shards failed") {
+				return nil
+			}
+
+			return fmt.Errorf("failed to run search (esdsl): %s", err)
+		}
+
+		slog.Debug("ES result", "search", res)
+
+		for _, hit := range res.Hits.Hits {
+			_, exists := docs[*hit.Id_]
+			if exists {
+				continue
+			}
+
+			printer.PrintDoc(conf, hit)
+
+			docs[*hit.Id_] = 1
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+}

pkg/es/search_filter.go

@@ -0,0 +1,238 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/operator"
+)
+
+const (
+	Fmust = iota
+	Fmustnot
+	Fshould
+)
+
+// hold filter configuration, can be used multiple times through a search
+type filter struct {
+	term, filter string   // message=foo
+	mterm        []string // multi_match
+	criteria     int      // must(=), mustnot(!=), should(?)
+	multi        bool     // message,title=foo => filter:foo, multi: []string{"message","title"}
+}
+
+// Build a new  filter object. We use this to  build our elastic query
+// out of it. We support differnt types of queries:
+//
+//   - nop filter: no query at all, just return the first N documents.
+//
+//   - simple ones like: "authenticated", which match across all fields
+//
+//   - simple ones combined like "authenticated monitoring", if -O was set,
+//     apply an OR logic
+//
+//   - specific field queries: "message=authenticated" (can be combined too like above)
+//
+//   - and specific field queries with negation: "message!=authenticated"
+//
+// All queries support additional  filters using -F field=value, which
+// must match literally, and range filters using -r "@timestamp:2026-05-28T10:00:00 to now"
+func NewFilter(query string) (*filter, error) {
+	var separator string
+	var criteria int // we use the constants on top for this
+
+	switch {
+	case strings.Contains(query, "!="):
+		criteria = Fmustnot
+		separator = "!="
+	default:
+		criteria = Fmust
+		separator = "="
+	}
+
+	part := strings.Split(query, separator)
+	if len(part) != 2 {
+		return nil, fmt.Errorf("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
+	}
+
+	flt := &filter{term: part[0], filter: part[1], criteria: criteria}
+
+	if strings.Contains(part[0], ",") {
+		// a MultiMatchQuery, match across multiple fields at once
+		multi := strings.Split(part[0], ",")
+		flt.multi = true
+		flt.mterm = multi
+	}
+
+	return flt, nil
+}
+
+// Build a complex query set for queries containing field[!]=pattern
+func mkMatchQueries(queries []string, op operator.Operator) ([]types.QueryVariant, []types.QueryVariant, error) {
+	matchqueries := []types.QueryVariant{}
+	matchNotqueries := []types.QueryVariant{}
+
+	for _, q := range queries {
+		filter, err := NewFilter(q)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// by default we match on a single field
+		var match types.QueryVariant = esdsl.NewMatchQuery(filter.term, filter.filter)
+
+		if filter.multi {
+			// ok, match across multiple given fields
+			match = esdsl.NewMultiMatchQuery(filter.filter).Fields(filter.mterm...).Operator(op)
+		}
+
+		if filter.criteria == Fmustnot {
+			matchNotqueries = append(matchNotqueries, match)
+		} else {
+			matchqueries = append(matchqueries, match)
+		}
+	}
+
+	return matchqueries, matchNotqueries, nil
+}
+
+// Prepare user search query and turn it into a proper search request
+func prepareQuery(conf *cfg.Config, queries []string) (*types.Query, error) {
+	// logical operator for simple and multimatch queries
+	op := operator.Operator{Name: "AND"}
+	if conf.Or {
+		op = operator.Operator{Name: "OR"}
+	}
+
+	query := esdsl.NewBoolQuery()
+	wholeQuery := strings.Join(queries, " ")
+
+	switch {
+	case len(queries) == 0:
+		// nothing provided via ARGs, so match any docs
+		query.Must(esdsl.NewMatchAllQuery())
+
+	case !strings.ContainsAny(wholeQuery, "!="):
+		// simple query w/o any field[!]=pattern style
+		query.Must(esdsl.NewSimpleQueryStringQuery(wholeQuery).DefaultOperator(op))
+
+	default:
+		// a complex query
+		matchqueries, matchNotqueries, err := mkMatchQueries(queries, op)
+		if err != nil {
+			return nil, err
+		}
+
+		// apply boolean logic
+		if conf.Or {
+			query.Should(matchqueries...)
+		} else {
+			// by default we use AND
+			query.Must(matchqueries...)
+		}
+
+		if matchNotqueries != nil {
+			query.MustNot(matchNotqueries...)
+		}
+	}
+
+	slog.Debug("complex query", "query", query)
+
+	// there might be boolean or range filters like -Ffield=value as well
+	filters, err := addFilters(conf)
+	if err != nil {
+		return nil, err
+	}
+
+	if filters != nil {
+		query.Filter(filters...)
+	}
+
+	return query.QueryCaster(), nil
+}
+
+// Build a slice of filters, to be fed into query.Filter() including static ones
+// like -Ffield=value and ranges like -r "@timestamp:2026-05-28T10:00:00 to now"
+func addFilters(conf *cfg.Config) ([]types.QueryVariant, error) {
+	count := len(conf.Filter)
+	if conf.Range != "" {
+		count++
+	}
+
+	if count == 0 {
+		return nil, nil
+	}
+
+	filters := make([]types.QueryVariant, count)
+
+	// static filters
+	for idx, filter := range conf.Filter {
+		parts := strings.Split(filter, "=")
+		if len(parts) != 2 {
+			return nil, fmt.Errorf("invalid filter spec: %s, expecting key=value", filter)
+		}
+
+		filters[idx] = esdsl.NewTermQuery(parts[0], esdsl.NewFieldValue().String(parts[1]))
+	}
+
+	// range filters. format: @timestamp:2026-05-05 to 2026-05-15
+	// see: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math
+	if conf.Range != "" {
+		parts := strings.SplitN(conf.Range, ":", 2)
+		if len(parts) != 2 {
+			return nil, errors.New("invalid range format, expected field:range")
+		}
+
+		field := parts[0]
+
+		parts = strings.Split(parts[1], " to ")
+		if len(parts) != 2 {
+			return nil, errors.New("invalid date range format, expected '<start> to <end>'")
+		}
+
+		from := parts[0]
+		to := parts[1]
+
+		slog.Debug("time range filter",
+			"from", from,
+			"to", to,
+			"format", conf.TimestampFormat,
+			"count", count,
+		)
+
+		rng := esdsl.NewDateRangeQuery(field).
+			Gte(from).
+			Lte(to)
+
+		if strings.Contains(parts[1], ":") {
+			// specific format not needed as long as there are no times specified
+			rng.Format(conf.TimestampFormat)
+		}
+
+		filters[count-1] = rng
+
+	}
+
+	return filters, nil
+}

pkg/printer/color.go

@@ -24,6 +24,7 @@ import (
 
 var (
 	green  = color.New(color.BgGreen, color.FgHiWhite).SprintFunc()
+	yellow = color.New(color.BgYellow, color.FgHiWhite).SprintFunc()
 	orange = color.BgRGB(255, 128, 0).AddRGB(0, 0, 0).SprintFunc()
 	red    = color.New(color.BgRed, color.FgHiWhite).SprintFunc()
 	bold   = color.New(color.Bold).SprintFunc()
@@ -42,6 +43,8 @@ func Colorize(conf *cfg.Config, col, what string) string {
 		what = orange(what)
 	case "red":
 		what = red(what)
+	case "yellow":
+		what = yellow(what)
 	}
 
 	return what

pkg/printer/doc.go

@@ -0,0 +1,45 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package printer
+
+import (
+	"fmt"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+	"github.com/tidwall/gjson"
+)
+
+func PrintDoc(conf *cfg.Config, hit types.Hit) {
+	var score types.Float64
+	if hit.Score_ != nil {
+		score = *hit.Score_
+	}
+
+	docjson := fmt.Sprintf(`{"id":"%s", "score":%0.4f, "index":"%s", "source":%s}`,
+		*hit.Id_,
+		score,
+		hit.Index_,
+		hit.Source_)
+
+	if conf.Path != "" {
+		value := gjson.Get(docjson, conf.Path)
+		fmt.Println(value.String())
+	} else {
+		fmt.Println(docjson)
+	}
+}

pkg/printer/table.go

@@ -285,9 +285,9 @@ func (data *Table) Addheaders(headers ...string) {
 	for idx, header := range headers {
 		switch data.Mode {
 		case "json", "yaml":
-			data.Headers[idx] = strings.ToLower(header)
+			data.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
 		default:
-			data.Headers[idx] = bold(strings.ToUpper(header))
+			data.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
 		}
 	}
 }