always show actions

fix transport http headers
show green and failed indices in status, rename red to failed in index ls
2026-08-25 01:04:18 +02:00 · 2026-07-08 10:20:02 +02:00 · 2026-07-08 10:19:48 +02:00 · 2026-07-08 09:57:39 +02:00
29 changed files with 102 additions and 1480 deletions
--- a/4
+++ b/4
@@ -67,10 +67,10 @@ test: clean buildlocal
 testlint: test lint
-lint-basic:
+lint:
 	golangci-lint run --enable-only errcheck,govet,ineffassign,staticcheck,unused
-lint:
+lint-full:
 	golangci-lint run --show-stats=false
 testfuzzy: clean
--- a/README.md
+++ b/README.md
@@ -538,7 +538,6 @@ index                       - manage indicies
  close                     - close an index
  fields                    - show info about field capabilities
  ilm                       - show ilm status
  du                        - show index disk usage
  alias                     - manage index aliases
    create                  - create an index alias
    list                    - list index aliases
@@ -556,7 +555,6 @@ node                        - manage nodes
  list                      - list nodes
  show                      - show details about a node
  clients                   - show node http clients
  usage                     - show node usage stats
 role                        - manage roles
  list                      - list roles
  show                      - show details about a role
@@ -576,7 +574,6 @@ version                     - show esctl version information
 debug                       - developer only
 help-jsonpath               - show jsonpath help
 help-usage                  - show overview of all available commands
 help-esql                   - show esql help
 ```
 # Development
--- a/assets/assets.go
+++ b/assets/assets.go
@@ -24,11 +24,10 @@ import (
 	"github.com/go-openapi/swag/loading"
 )
-//go:embed *.json *.md
+//go:embed *.json
 var AssetFS embed.FS
 var OpenAPI *loads.Document
 var EsQlCheatSheet string
 func LoadAssetOpenApi() {
 	doc, err := loads.Spec(
@@ -42,12 +41,3 @@ func LoadAssetOpenApi() {
 	OpenAPI = doc
 }
 func LoadEsql() {
 	md, err := AssetFS.ReadFile("esql.md")
 	if err != nil {
 		panic(err)
 	}
 	EsQlCheatSheet = string(md)
 }
--- a/assets/esql.md
+++ b/assets/esql.md
@@ -1,951 +0,0 @@
 <!-- courtesy https://github.com/linkan-per/ES-QL-Cheat-Sheet by |linkan-per -->
 # ES|QL (Elasticsearch Query Language) Cheat Sheet
 ## Table of Contents
 1. [Introduction](#introduction)
 2. [Basic Query Structure](#basic-query-structure)
 3. [Source Commands](#source-commands)
 4. [Processing Commands](#processing-commands)
 5. [Data Selection & Filtering](#data-selection--filtering)
 6. [Aggregations & Statistics](#aggregations--statistics)
 7. [String Functions](#string-functions)
 8. [Mathematical Functions](#mathematical-functions)
 9. [Date/Time Functions](#datetime-functions)
 10. [Type Conversion Functions](#type-conversion-functions)
 11. [Conditional Functions](#conditional-functions)
 12. [Array Functions](#array-functions)
 13. [Join Operations (LOOKUP)](#join-operations-lookup)
 14. [Sorting & Limiting](#sorting--limiting)
 15. [Grouping & Aggregating](#grouping--aggregating)
 16. [Advanced Patterns](#advanced-patterns)
 ---
 ## Introduction
 ES|QL is Elasticsearch's new query language designed for data exploration, analysis, and transformation. It uses a pipe (`|`) syntax to chain commands together.
 **Basic Syntax:**
 ```
 FROM <data-source>
 | <processing-command>
 | <processing-command>
 | ...
 ```
 ---
 ## Basic Query Structure
 ### Simple Query
 ```esql
 FROM logs-*
 | LIMIT 10
 ```
 ### Query with Multiple Commands
 ```esql
 FROM employees
 | WHERE department == "Engineering"
 | KEEP name, salary, hire_date
 | SORT salary DESC
 | LIMIT 5
 ```
 ---
 ## Source Commands
 ### FROM - Specify Data Source
 ```esql
 // From a single index
 FROM logs-2024
 // From multiple indices with wildcard
 FROM logs-*, metrics-*
 // From specific indices
 FROM index1, index2, index3
 // With metadata
 FROM logs-* METADATA _id, _index
 ```
 ### ROW - Generate Inline Data
 ```esql
 // Create a single row
 ROW name = "John", age = 30, city = "NYC"
 // Multiple rows
 ROW a = 1, b = "x"
 | EVAL c = a * 10
 ```
 ---
 ## Processing Commands
 ### KEEP - Select Specific Fields
 ```esql
 FROM employees
 | KEEP name, department, salary
 // Keep with pattern
 FROM logs-*
 | KEEP @timestamp, message, host.*
 ```
 ### DROP - Remove Specific Fields
 ```esql
 FROM employees
 | DROP password, ssn, internal_notes
 // Drop with pattern
 FROM logs-*
 | DROP *.keyword
 ```
 ### RENAME - Rename Fields
 ```esql
 FROM employees
 | RENAME emp_name AS name, emp_dept AS department
 // Multiple renames
 FROM logs-*
 | RENAME source.ip AS src_ip, destination.ip AS dst_ip
 ```
 ---
 ## Data Selection & Filtering
 ### WHERE - Filter Rows
 ```esql
 // Equality
 FROM employees
 | WHERE department == "Sales"
 // Comparison operators
 FROM products
 | WHERE price > 100 AND stock < 50
 // IS NULL / IS NOT NULL
 FROM logs-*
 | WHERE error_code IS NOT NULL
 // IN operator
 FROM employees
 | WHERE department IN ("Sales", "Marketing", "HR")
 // LIKE operator (wildcards)
 FROM logs-*
 | WHERE message LIKE "*error*"
 // RLIKE operator (regex)
 FROM logs-*
 | WHERE message RLIKE "error|exception|failure"
 // NOT operator
 FROM employees
 | WHERE NOT department == "IT"
 // Multiple conditions
 FROM orders
 | WHERE status == "completed" 
  AND total_amount > 1000 
  AND order_date >= "2024-01-01"
 ```
 ---
 ## Aggregations & Statistics
 ### STATS - Aggregate Functions
 #### COUNT
 ```esql
 // Count all rows
 FROM logs-*
 | STATS count = COUNT()
 // Count distinct
 FROM employees
 | STATS unique_departments = COUNT_DISTINCT(department)
 // Count by group
 FROM logs-*
 | STATS event_count = COUNT() BY log_level
 ```
 #### SUM, AVG, MIN, MAX
 ```esql
 FROM sales
 | STATS 
    total_revenue = SUM(amount),
    avg_sale = AVG(amount),
    min_sale = MIN(amount),
    max_sale = MAX(amount)
 // With grouping
 FROM sales
 | STATS 
    total = SUM(amount),
    average = AVG(amount)
  BY product_category
 ```
 #### MEDIAN, PERCENTILE
 ```esql
 FROM response_times
 | STATS 
    median_time = MEDIAN(duration),
    p95 = PERCENTILE(duration, 95),
    p99 = PERCENTILE(duration, 99)
 ```
 #### Multiple Aggregations
 ```esql
 FROM orders
 | STATS 
    order_count = COUNT(),
    total_revenue = SUM(amount),
    avg_order_value = AVG(amount),
    unique_customers = COUNT_DISTINCT(customer_id)
  BY region, product_category
 ```
 ---
 ## String Functions
 ### CONCAT - Concatenate Strings
 ```esql
 FROM employees
 | EVAL full_name = CONCAT(first_name, " ", last_name)
 // With separator
 FROM logs-*
 | EVAL log_info = CONCAT(level, ": ", message)
 ```
 ### SUBSTRING - Extract Substring
 ```esql
 FROM employees
 | EVAL first_initial = SUBSTRING(first_name, 0, 1)
 // Extract with length
 FROM products
 | EVAL short_code = SUBSTRING(product_id, 0, 5)
 ```
 ### LENGTH - String Length
 ```esql
 FROM messages
 | EVAL message_length = LENGTH(message)
 | WHERE message_length > 100
 ```
 ### TRIM, LTRIM, RTRIM - Remove Whitespace
 ```esql
 FROM user_input
 | EVAL cleaned = TRIM(input_field)
 | EVAL left_trimmed = LTRIM(input_field)
 | EVAL right_trimmed = RTRIM(input_field)
 ```
 ### UPPER, LOWER - Case Conversion
 ```esql
 FROM employees
 | EVAL name_upper = UPPER(name)
 | EVAL email_lower = LOWER(email)
 ```
 ### REPLACE - Replace String
 ```esql
 FROM logs-*
 | EVAL cleaned_message = REPLACE(message, "ERROR", "Warning")
 ```
 ### SPLIT - Split String into Array
 ```esql
 FROM logs-*
 | EVAL tags_array = SPLIT(tags, ",")
 ```
 ### STARTS_WITH, ENDS_WITH
 ```esql
 FROM files
 | WHERE STARTS_WITH(filename, "log_")
 | WHERE ENDS_WITH(filename, ".txt")
 ```
 ---
 ## Mathematical Functions
 ### Basic Operations
 ```esql
 FROM sales
 | EVAL 
    total = price * quantity,
    discount_price = price * 0.9,
    tax = price * 0.08
 // Multiple operations
 FROM metrics
 | EVAL 
    sum_val = field1 + field2,
    diff_val = field1 - field2,
    product = field1 * field2,
    ratio = field1 / field2,
    remainder = field1 % field2
 ```
 ### ABS - Absolute Value
 ```esql
 FROM transactions
 | EVAL abs_amount = ABS(transaction_amount)
 ```
 ### ROUND, FLOOR, CEIL
 ```esql
 FROM measurements
 | EVAL 
    rounded = ROUND(value, 2),
    floored = FLOOR(value),
    ceiled = CEIL(value)
 ```
 ### POW - Power
 ```esql
 FROM data
 | EVAL squared = POW(value, 2)
 | EVAL cubed = POW(value, 3)
 ```
 ### SQRT - Square Root
 ```esql
 FROM measurements
 | EVAL sqrt_value = SQRT(value)
 ```
 ### LOG, LOG10
 ```esql
 FROM data
 | EVAL 
    natural_log = LOG(value),
    log_base_10 = LOG10(value)
 ```
 ### GREATEST, LEAST
 ```esql
 FROM comparisons
 | EVAL 
    max_val = GREATEST(val1, val2, val3),
    min_val = LEAST(val1, val2, val3)
 ```
 ---
 ## Date/Time Functions
 ### NOW - Current Timestamp
 ```esql
 FROM logs-*
 | EVAL current_time = NOW()
 ```
 ### DATE_EXTRACT - Extract Date Parts
 ```esql
 FROM events
 | EVAL 
    year = DATE_EXTRACT("year", @timestamp),
    month = DATE_EXTRACT("month", @timestamp),
    day = DATE_EXTRACT("day", @timestamp),
    hour = DATE_EXTRACT("hour", @timestamp),
    minute = DATE_EXTRACT("minute", @timestamp),
    day_of_week = DATE_EXTRACT("day_of_week", @timestamp)
 ```
 ### DATE_FORMAT - Format Date
 ```esql
 FROM events
 | EVAL formatted_date = DATE_FORMAT("yyyy-MM-dd", @timestamp)
 | EVAL custom_format = DATE_FORMAT("MMM dd, yyyy HH:mm", @timestamp)
 ```
 ### DATE_TRUNC - Truncate Date
 ```esql
 FROM logs-*
 | EVAL 
    hour_bucket = DATE_TRUNC("hour", @timestamp),
    day_bucket = DATE_TRUNC("day", @timestamp),
    month_bucket = DATE_TRUNC("month", @timestamp)
 ```
 ### DATE_DIFF - Date Difference
 ```esql
 FROM orders
 | EVAL days_since_order = DATE_DIFF("days", order_date, NOW())
 | EVAL hours_to_delivery = DATE_DIFF("hours", order_date, delivery_date)
 ```
 ### DATE_PARSE - Parse String to Date
 ```esql
 FROM data
 | EVAL parsed_date = DATE_PARSE("yyyy-MM-dd", date_string)
 ```
 ---
 ## Type Conversion Functions
 ### TO_STRING - Convert to String
 ```esql
 FROM data
 | EVAL id_string = TO_STRING(id)
 | EVAL amount_string = TO_STRING(amount)
 ```
 ### TO_INTEGER, TO_LONG - Convert to Integer
 ```esql
 FROM data
 | EVAL age_int = TO_INTEGER(age_string)
 | EVAL id_long = TO_LONG(id_string)
 ```
 ### TO_DOUBLE - Convert to Double
 ```esql
 FROM data
 | EVAL price_double = TO_DOUBLE(price_string)
 ```
 ### TO_BOOLEAN - Convert to Boolean
 ```esql
 FROM data
 | EVAL is_active = TO_BOOLEAN(active_string)
 ```
 ### TO_DATETIME - Convert to DateTime
 ```esql
 FROM data
 | EVAL timestamp = TO_DATETIME(date_string)
 ```
 ### TO_IP - Convert to IP Address
 ```esql
 FROM logs-*
 | EVAL ip_address = TO_IP(ip_string)
 ```
 ---
 ## Conditional Functions
 ### CASE - Conditional Logic
 ```esql
 FROM employees
 | EVAL salary_grade = CASE(
    salary < 50000, "Entry",
    salary < 80000, "Mid",
    salary < 120000, "Senior",
    "Executive"
  )
 // With multiple conditions
 FROM orders
 | EVAL order_status = CASE(
    status == "pending" AND days_old > 7, "Overdue",
    status == "pending", "Processing",
    status == "shipped", "In Transit",
    status == "delivered", "Completed",
    "Unknown"
  )
 ```
 ### COALESCE - Return First Non-Null Value
 ```esql
 FROM data
 | EVAL display_name = COALESCE(nickname, first_name, username, "Unknown")
 ```
 ### IF - Simple Conditional
 ```esql
 FROM products
 | EVAL stock_status = 
    CASE(stock > 0, "Available", "Out of Stock")
 // Nested conditions
 FROM employees
 | EVAL bonus = CASE(
    performance_rating >= 4.5, salary * 0.15,
    performance_rating >= 3.5, salary * 0.10,
    performance_rating >= 2.5, salary * 0.05,
    0
  )
 ```
 ---
 ## Array Functions
 ### MV_COUNT - Count Array Elements
 ```esql
 FROM logs-*
 | EVAL tag_count = MV_COUNT(tags)
 | WHERE tag_count > 3
 ```
 ### MV_AVG, MV_SUM, MV_MIN, MV_MAX - Array Aggregations
 ```esql
 FROM metrics
 | EVAL 
    avg_value = MV_AVG(values),
    total = MV_SUM(values),
    min_value = MV_MIN(values),
    max_value = MV_MAX(values)
 ```
 ### MV_CONCAT - Concatenate Array Elements
 ```esql
 FROM logs-*
 | EVAL all_tags = MV_CONCAT(tags, ", ")
 ```
 ### MV_DEDUPE - Remove Duplicates from Array
 ```esql
 FROM data
 | EVAL unique_values = MV_DEDUPE(values)
 ```
 ### MV_FIRST, MV_LAST - Get First/Last Element
 ```esql
 FROM logs-*
 | EVAL first_tag = MV_FIRST(tags)
 | EVAL last_tag = MV_LAST(tags)
 ```
 ### MV_SLICE - Extract Array Slice
 ```esql
 FROM data
 | EVAL first_three = MV_SLICE(values, 0, 3)
 ```
 ---
 ## Join Operations (LOOKUP)
 ES|QL uses ENRICH (similar to LOOKUP/JOIN) to join data from enrich policies.
 ### Prerequisites: Create Enrich Policy
 First, create an enrich policy in Kibana Dev Tools:
 ```json
 PUT /_enrich/policy/user_lookup
 {
  "match": {
    "indices": "users",
    "match_field": "user_id",
    "enrich_fields": ["username", "email", "department"]
  }
 }
 POST /_enrich/policy/user_lookup/_execute
 ```
 ### ENRICH - Join/Lookup Data
 ```esql
 FROM logs-*
 | ENRICH user_lookup ON user_id
 | KEEP @timestamp, user_id, username, email, message
 // With field renaming
 FROM transactions
 | ENRICH product_lookup ON product_id WITH product_name, category, price
 | KEEP transaction_id, product_name, category, quantity, price
 // Multiple enrichments
 FROM orders
 | ENRICH customer_lookup ON customer_id WITH customer_name, customer_tier
 | ENRICH product_lookup ON product_id WITH product_name, product_category
 | KEEP order_id, customer_name, product_name, order_amount
 ```
 ### Complex Join Example
 ```esql
 FROM orders
 | ENRICH customer_lookup ON customer_id 
    WITH customer_name, customer_email, customer_segment
 | ENRICH product_lookup ON product_id 
    WITH product_name, product_category, product_price
 | EVAL total_price = quantity * product_price
 | WHERE customer_segment == "Premium"
 | STATS 
    total_orders = COUNT(),
    total_revenue = SUM(total_price)
  BY customer_name, product_category
 | SORT total_revenue DESC
 ```
 ---
 ## Sorting & Limiting
 ### SORT - Order Results
 ```esql
 // Ascending order (default)
 FROM employees
 | SORT salary
 // Descending order
 FROM employees
 | SORT salary DESC
 // Multiple fields
 FROM employees
 | SORT department ASC, salary DESC
 // With nulls first/last
 FROM data
 | SORT value DESC NULLS FIRST
 ```
 ### LIMIT - Limit Results
 ```esql
 // Get first 10 rows
 FROM logs-*
 | LIMIT 10
 // Top 5 highest salaries
 FROM employees
 | SORT salary DESC
 | LIMIT 5
 // Pagination (skip and limit)
 FROM products
 | SORT price
 | LIMIT 20  // Results 0-19
 ```
 ### HEAD - Get First N Rows (Alias for LIMIT)
 ```esql
 FROM logs-*
 | HEAD 100
 ```
 ---
 ## Grouping & Aggregating
 ### GROUP BY with STATS
 ```esql
 // Single field grouping
 FROM sales
 | STATS total_sales = SUM(amount) BY region
 // Multiple field grouping
 FROM orders
 | STATS 
    order_count = COUNT(),
    total_revenue = SUM(amount)
  BY region, product_category, sales_rep
 // Time-based grouping
 FROM logs-*
 | EVAL hour = DATE_TRUNC("hour", @timestamp)
 | STATS event_count = COUNT() BY hour, log_level
 | SORT hour DESC
 ```
 ### Complex Aggregation Example
 ```esql
 FROM sales_data
 | WHERE order_date >= "2024-01-01"
 | EVAL month = DATE_TRUNC("month", order_date)
 | STATS 
    total_orders = COUNT(),
    total_revenue = SUM(amount),
    avg_order_value = AVG(amount),
    unique_customers = COUNT_DISTINCT(customer_id),
    max_order = MAX(amount),
    min_order = MIN(amount)
  BY month, region, product_category
 | EVAL revenue_per_customer = total_revenue / unique_customers
 | WHERE total_orders > 100
 | SORT month DESC, total_revenue DESC
 | LIMIT 50
 ```
 ---
 ## Advanced Patterns
 ### Window Functions Pattern
 ```esql
 // Running total by group
 FROM sales
 | SORT date
 | STATS 
    daily_sales = SUM(amount),
    order_count = COUNT()
  BY date, region
 | SORT region, date
 ```
 ### Pivoting Data
 ```esql
 // Count by status and priority
 FROM tickets
 | STATS ticket_count = COUNT() BY status, priority
 | SORT status, priority
 ```
 ### Finding Duplicates
 ```esql
 FROM users
 | STATS count = COUNT() BY email
 | WHERE count > 1
 | SORT count DESC
 ```
 ### Time Series Analysis
 ```esql
 FROM metrics-*
 | EVAL 
    hour = DATE_TRUNC("hour", @timestamp),
    day = DATE_EXTRACT("day", @timestamp)
 | STATS 
    avg_cpu = AVG(cpu_percent),
    max_cpu = MAX(cpu_percent),
    avg_memory = AVG(memory_percent)
  BY hour, host
 | WHERE avg_cpu > 80
 | SORT hour DESC
 ```
 ### Percentage Calculations
 ```esql
 FROM sales
 | STATS 
    total_sales = SUM(amount),
    count = COUNT()
  BY product_category
 | EVAL percentage = ROUND(total_sales / SUM(total_sales) * 100, 2)
 | SORT percentage DESC
 ```
 ### Top N per Group
 ```esql
 // Top 3 products per category by sales
 FROM sales
 | STATS total_sales = SUM(amount) BY product_category, product_name
 | SORT product_category, total_sales DESC
 // Note: ES|QL doesn't have native PARTITION BY, 
 // so you may need to process this in multiple queries or use aggregations
 ```
 ### Data Cleaning
 ```esql
 FROM raw_data
 | EVAL 
    // Clean whitespace
    cleaned_name = TRIM(name),
    // Standardize case
    email_lower = LOWER(email),
    // Replace values
    status = REPLACE(status, "N/A", "Unknown"),
    // Handle nulls
    age = COALESCE(age, 0),
    // Validate ranges
    valid_age = CASE(age < 0 OR age > 150, NULL, age)
 | WHERE cleaned_name IS NOT NULL
 | DROP name, email
 | RENAME cleaned_name AS name, email_lower AS email
 ```
 ### Cohort Analysis
 ```esql
 FROM user_events
 | EVAL 
    signup_month = DATE_TRUNC("month", signup_date),
    event_month = DATE_TRUNC("month", event_date)
 | STATS 
    active_users = COUNT_DISTINCT(user_id)
  BY signup_month, event_month
 | SORT signup_month, event_month
 ```
 ### Anomaly Detection Pattern
 ```esql
 FROM metrics-*
 | EVAL hour = DATE_TRUNC("hour", @timestamp)
 | STATS 
    avg_value = AVG(value),
    stddev = SQRT(AVG(POW(value - AVG(value), 2)))
  BY hour
 | EVAL 
    upper_bound = avg_value + (2 * stddev),
    lower_bound = avg_value - (2 * stddev)
 ```
 ---
 ## Complete Real-World Examples
 ### Example 1: User Activity Dashboard
 ```esql
 FROM user_logs-*
 | WHERE @timestamp >= NOW() - 7 days
 | ENRICH user_lookup ON user_id WITH username, user_tier
 | EVAL day = DATE_TRUNC("day", @timestamp)
 | STATS 
    daily_active_users = COUNT_DISTINCT(user_id),
    total_sessions = COUNT(),
    avg_session_duration = AVG(session_duration)
  BY day, user_tier
 | EVAL avg_duration_minutes = ROUND(avg_session_duration / 60, 2)
 | SORT day DESC, user_tier
 ```
 ### Example 2: E-commerce Sales Report
 ```esql
 FROM orders
 | WHERE order_date >= "2024-01-01"
 | ENRICH customer_lookup ON customer_id 
    WITH customer_name, customer_segment
 | ENRICH product_lookup ON product_id 
    WITH product_name, product_category, cost_price
 | EVAL 
    profit = (price - cost_price) * quantity,
    month = DATE_TRUNC("month", order_date)
 | STATS 
    total_orders = COUNT(),
    total_revenue = SUM(price * quantity),
    total_profit = SUM(profit),
    avg_order_value = AVG(price * quantity),
    unique_customers = COUNT_DISTINCT(customer_id)
  BY month, product_category, customer_segment
 | EVAL profit_margin = ROUND(total_profit / total_revenue * 100, 2)
 | WHERE total_revenue > 10000
 | SORT month DESC, total_revenue DESC
 | LIMIT 100
 ```
 ### Example 3: Security Log Analysis
 ```esql
 FROM security-logs-*
 | WHERE @timestamp >= NOW() - 24 hours
 | WHERE event_type IN ("login_failed", "suspicious_activity")
 | EVAL hour = DATE_TRUNC("hour", @timestamp)
 | STATS 
    event_count = COUNT(),
    unique_ips = COUNT_DISTINCT(source_ip),
    unique_users = COUNT_DISTINCT(username)
  BY hour, event_type, country
 | WHERE event_count > 100
 | SORT hour DESC, event_count DESC
 ```
 ### Example 4: Application Performance Monitoring
 ```esql
 FROM apm-*
 | WHERE @timestamp >= NOW() - 1 hour
 | EVAL 
    response_category = CASE(
        response_time < 100, "Fast",
        response_time < 500, "Medium",
        response_time < 1000, "Slow",
        "Very Slow"
    ),
    minute = DATE_TRUNC("minute", @timestamp)
 | STATS 
    request_count = COUNT(),
    avg_response = AVG(response_time),
    p95_response = PERCENTILE(response_time, 95),
    p99_response = PERCENTILE(response_time, 99),
    error_count = COUNT() WHERE status_code >= 400
  BY minute, endpoint, response_category
 | EVAL error_rate = ROUND(error_count / request_count * 100, 2)
 | WHERE request_count > 10
 | SORT minute DESC, avg_response DESC
 ```
 ---
 ## Tips & Best Practices
 1. **Use KEEP instead of SELECT** - More explicit about which fields to retain
 2. **Filter early with WHERE** - Reduce data processing by filtering before aggregations
 3. **Use DATE_TRUNC for time bucketing** - Essential for time series analysis
 4. **Leverage ENRICH for joins** - Pre-create enrich policies for frequently joined data
 5. **Use EVAL for calculated fields** - Create derived fields before aggregation
 6. **Combine multiple conditions in WHERE** - More efficient than multiple WHERE clauses
 7. **Use STATS with BY for grouping** - Replaces traditional GROUP BY
 8. **Sort after aggregation** - More efficient than sorting before
 9. **Use LIMIT to control output size** - Especially important for large datasets
 10. **Use metadata fields when needed** - Access _id, _index with METADATA keyword
 ---
 ## Common Patterns Cheat Sheet
 ```esql
 // Count by field
 FROM index | STATS count = COUNT() BY field
 // Top N
 FROM index | STATS value = SUM(amount) BY category | SORT value DESC | LIMIT 10
 // Time series
 FROM index | EVAL bucket = DATE_TRUNC("hour", @timestamp) | STATS count = COUNT() BY bucket
 // Percentage of total
 FROM index | STATS total = SUM(amount) BY category | EVAL pct = total / SUM(total) * 100
 // Filter nulls
 FROM index | WHERE field IS NOT NULL
 // String matching
 FROM index | WHERE field LIKE "*pattern*"
 // Date range
 FROM index | WHERE @timestamp >= NOW() - 7 days
 // Multiple aggregations
 FROM index | STATS count = COUNT(), sum = SUM(val), avg = AVG(val) BY group
 // Conditional aggregation
 FROM index | STATS error_count = COUNT() WHERE status == "error" BY service
 ```
 ---
 ## Comparison with Traditional SQL
 | SQL | ES|QL |
 |-----|-------|
 | SELECT * | FROM index |
 | SELECT field1, field2 | FROM index \| KEEP field1, field2 |
 | WHERE condition | WHERE condition (same) |
 | GROUP BY field | STATS ... BY field |
 | ORDER BY field | SORT field |
 | LIMIT 10 | LIMIT 10 (same) |
 | COUNT(*) | STATS count = COUNT() |
 | SUM(field) | STATS total = SUM(field) |
 | AVG(field) | STATS avg = AVG(field) |
 | JOIN | ENRICH (using enrich policies) |
 | CASE WHEN | CASE(...) |
 | CONCAT(a, b) | CONCAT(a, b) (same) |
 ---
 ## Resources
 - Official ES|QL Documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html
 - ES|QL Functions Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-functions.html
 - Enrich Processor: https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html
 ---
 *Last Updated: 2024*
 *ES|QL is actively evolving - check official documentation for latest features*
--- a/cmd/api.go
+++ b/cmd/api.go
@@ -72,7 +72,7 @@ func ApiShow(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Capi)
+			complete(cmd, Capi)
 		},
 	}
 }
@@ -91,12 +91,6 @@ func ApiRepl(conf *cfg.Config) *cli.Command {
 				Aliases:     []string{"p"},
 				Sources:     cli.EnvVars("PAGER", "ES_JSON_PAGER"),
 			},
 			&cli.BoolFlag{
 				Name:        "human-readable-cat",
 				Usage:       "enable human readable /_cat output",
 				Destination: &conf.HumanCat,
 				Aliases:     []string{"H"},
 			},
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/ccr.go
+++ b/cmd/ccr.go
@@ -59,7 +59,7 @@ func CcrStatus(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Ccluster)
+			complete(cmd, Ccluster)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -115,7 +115,7 @@ func CcrRemoteInfo(conf *cfg.Config) *cli.Command {
 		UsageText: "info [options] [<index>]",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/ccr_follower.go
+++ b/cmd/ccr_follower.go
@@ -60,7 +60,7 @@ func CcrFollowerRenew(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -82,7 +82,7 @@ func CcrFollowerResume(conf *cfg.Config) *cli.Command {
 		UsageText: "resume [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -104,7 +104,7 @@ func CcrFollowerPause(conf *cfg.Config) *cli.Command {
 		UsageText: "pause [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -126,7 +126,7 @@ func CcrFollowerUnfollow(conf *cfg.Config) *cli.Command {
 		UsageText: "unfollow [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -158,7 +158,7 @@ func CcrFollowerAdd(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -181,7 +181,7 @@ func CcrFollowerDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -205,7 +205,7 @@ func CcrFollowerShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/cluster.go
+++ b/cmd/cluster.go
@@ -83,7 +83,7 @@ func ClusterSwitch(conf *cfg.Config) *cli.Command {
 		Aliases:   []string{"ctx"},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Ccluster)
+			complete(cmd, Ccluster)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/cluster_reroute.go
+++ b/cmd/cluster_reroute.go
@@ -50,7 +50,7 @@ func ClusterRerouteMove(conf *cfg.Config) *cli.Command {
 		UsageText: "move [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
@@ -95,7 +95,7 @@ func ClusterRerouteAllocateReplica(conf *cfg.Config) *cli.Command {
 		UsageText: "allocate-replica [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
@@ -133,7 +133,7 @@ func ClusterRerouteCancel(conf *cfg.Config) *cli.Command {
 		UsageText: "cancel [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
@@ -185,7 +185,7 @@ func ClusterRerouteAllocatePrimary(conf *cfg.Config, stale bool) *cli.Command {
 		UsageText: name + " [options] <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
--- a/cmd/cluster_settings.go
+++ b/cmd/cluster_settings.go
@@ -105,7 +105,7 @@ func ClusterSettingsSet(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cclustersettings)
+			complete(cmd, Cclustersettings)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/completion.go
+++ b/cmd/completion.go
@@ -36,11 +36,18 @@ const (
 	Cclustersettings
 )
-func complete(conf *cfg.Config, cmd *cli.Command, what int) {
+func complete(cmd *cli.Command, what int) {
 	if cmd.NArg() > 0 {
 		return
 	}
 	// FIXME: config should load from root.Before(), see https://github.com/urfave/cli/issues/2348
 	// workaround: load it directly here
 	conf := cfg.NewConfig()
 	if err := conf.Init(); err != nil {
 		return
 	}
 	var (
 		list []string
 		err  error
--- a/cmd/datastream.go
+++ b/cmd/datastream.go
@@ -91,7 +91,7 @@ func DatastreamShow(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cdatastream)
+			complete(cmd, Cdatastream)
 		},
 	}
 }
@@ -113,7 +113,7 @@ func DatastreamCreate(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cdatastream)
+			complete(cmd, Cdatastream)
 		},
 	}
 }
@@ -135,7 +135,7 @@ func DatastreamDelete(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cdatastream)
+			complete(cmd, Cdatastream)
 		},
 	}
 }
@@ -148,7 +148,7 @@ func DatastreamRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <data stream>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
@@ -205,7 +205,7 @@ func DatastreamIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "ds ilm <name>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cdatastream)
+			complete(cmd, Cdatastream)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/ilm.go
+++ b/cmd/ilm.go
@@ -123,7 +123,7 @@ func IlmShow(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cilm)
+			complete(cmd, Cilm)
 		},
 	}
 }
--- a/cmd/index.go
+++ b/cmd/index.go
@@ -41,7 +41,6 @@ func Index(conf *cfg.Config) *cli.Command {
 			IndexClose(conf),
 			IndexFields(conf),
 			IndexIlm(conf),
 			IndexDu(conf),
 			// sub commands
 			IndexAlias(conf),
@@ -111,7 +110,7 @@ func IndexShow(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 	}
 }
@@ -181,7 +180,7 @@ func IndexDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -202,7 +201,7 @@ func IndexClose(conf *cfg.Config) *cli.Command {
 		UsageText: "close <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -244,7 +243,7 @@ func IndexFields(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -265,7 +264,7 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "index ilm <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -278,24 +277,3 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
 func IndexDu(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "du",
 		Usage:     "show index disk usage",
 		UsageText: "index du <index>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
 			complete(conf, cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			index := cmd.Args().Get(0)
 			if index == "" {
 				return errors.New("no index specified")
 			}
 			return es.IndexDiskusage(conf, index)
 		},
 	}
 }
--- a/cmd/index_alias.go
+++ b/cmd/index_alias.go
@@ -52,7 +52,7 @@ func IndexAliasCreate(conf *cfg.Config) *cli.Command {
 		UsageText: "create <index> <alias>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -76,7 +76,7 @@ func IndexAliasDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index> <alias>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -100,7 +100,7 @@ func IndexAliasRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <alias>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 		Flags: []cli.Flag{
--- a/cmd/index_template.go
+++ b/cmd/index_template.go
@@ -71,7 +71,7 @@ func IndexTemplateShow(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 	}
 }
@@ -215,7 +215,7 @@ func IndexTemplateDelete(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cindex)
+			complete(cmd, Cindex)
 		},
 	}
 }
--- a/cmd/node.go
+++ b/cmd/node.go
@@ -36,7 +36,6 @@ func Node(conf *cfg.Config) *cli.Command {
 			NodeList(conf),
 			NodeShow(conf),
 			NodeClients(conf),
 			NodeUsage(conf),
 		},
 	}
 }
@@ -61,7 +60,7 @@ func NodeShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show [options] <node>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cnode)
+			complete(cmd, Cnode)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -91,7 +90,7 @@ func NodeClients(conf *cfg.Config) *cli.Command {
 		},
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Cnode)
+			complete(cmd, Cnode)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -104,19 +103,3 @@ func NodeClients(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
 func NodeUsage(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "usage",
 		Usage:     "show node usage stats",
 		UsageText: "usage [options] [<node>]",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
 			complete(conf, cmd, Cnode)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			return es.NodeUsage(conf, cmd.Args().Get(0))
 		},
 	}
 }
--- a/cmd/roles.go
+++ b/cmd/roles.go
@@ -68,7 +68,7 @@ func RoleShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show [options] <role>",
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(conf, cmd, Crole)
+			complete(cmd, Crole)
 		},
 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -24,13 +24,10 @@ import (
 	"runtime/pprof"
 	"strings"
 	"codeberg.org/scip/esctl/assets"
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
 	"codeberg.org/scip/esctl/pkg/printer"
 	markdown "github.com/MichaelMure/go-term-markdown"
 	"github.com/urfave/cli/v3"
 )
@@ -144,7 +141,7 @@ func Main() int {
 				Name:        "output",
 				Aliases:     []string{"o"},
 				Value:       "",
-				Usage:       "output mode (tsv, csv, json, yaml) default: tsv",
+				Usage:       "output mode (tsv, json, yaml) default: tsv",
 				Destination: &conf.Output,
 			},
 			&cli.StringFlag{
@@ -167,7 +164,6 @@ func Main() int {
 			Node(conf),
 			Roles(conf),
 			Search(conf),
 			SearchQL(conf),
 			Shard(conf),
 			Snapshot(conf),
 			Task(conf),
@@ -175,7 +171,6 @@ func Main() int {
 			Debug(conf),
 			HelpJsonPath(conf),
 			HelpUsage(conf),
 			HelpEsQl(conf),
 		},
 		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
@@ -231,22 +226,6 @@ func HelpJsonPath(conf *cfg.Config) *cli.Command {
 	}
 }
 func HelpEsQl(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "help-esql",
 		Usage: "show esql help",
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			assets.LoadEsql()
 			width := cfg.GetTermWidth()
 			printer.Pager("esql cheat sheet", string(markdown.Render(assets.EsQlCheatSheet, width, cfg.DefaultMargin)))
 			return nil
 		},
 	}
 }
 func Version(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "version",
--- a/cmd/search.go
+++ b/cmd/search.go
@@ -18,7 +18,6 @@ package cmd
 import (
 	"context"
 	"strings"
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -46,11 +45,6 @@ https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#dat
 For timestamp formats refer to:
 https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format`
 const QlUsage = `ES|QL documentation:
 https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started
 See also: esctl help-esql`
 func Search(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:               "search",
@@ -155,19 +149,3 @@ func Search(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
 func SearchQL(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:               "searchql",
 		Aliases:            []string{"/"},
 		Usage:              "search using ES/QL language",
 		UsageText:          "search <ES/QL term>",
 		CustomHelpTemplate: addReference(QlUsage),
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 			return es.SearchQL(conf, strings.Join(args.Slice(), " "))
 		},
 	}
 }
--- a/pkg/cfg/config.go
+++ b/pkg/cfg/config.go
@@ -102,7 +102,6 @@ type Config struct {
 	DryRun                              bool // rollover: -n
 	Tag string // api ls: -t
 	HumanCat bool   // api repl: -H
 	Ilm Ilm // ilm create
--- a/pkg/es/api.go
+++ b/pkg/es/api.go
@@ -45,25 +45,22 @@ import (
 )
 const (
-	intro = `# Input format: verb path [data]"
+	intro = `Input format: verb path [data]"
-# 
+
-# Example:
+Example:
-# 
+
-# post /yourindex/_ccr/pause_follow
+post /yourindex/_ccr/pause_follow
-# put /yourindex/_settings {"number_of_replicas": 1}
+put /yourindex/_settings {"number_of_replicas": 1}
-# 
+
-# You can also put multiline JSON after the path like:
+You can also put multiline JSON after the path like:
-# 
+
-# put /yourindex/_settings
+put /yourindex/_settings
-# {
+{
-#   "number_of_replicas": 1
+  "number_of_replicas": 1
-# }
+}
-# 
+
-# If you do NOT  supply a JSON in the first line, you  need to hit ENTER
+If you do NOT  supply a JSON in the first line, you  need to hit ENTER
-# twice to complete.
+twice to complete.`
 #
 # Supply the flag --human-readable-cat, -H to view /_cat API calls in
 # human readable form.`
 )
 // holds an API operation via go-openapi/spec
@@ -146,12 +143,8 @@ func ApiRepl(conf *cfg.Config) error {
 			fmt.Printf("failed to call API: %s\n", esErrorString(err))
 		}
 		if conf.HumanCat && strings.HasPrefix(parts[1], "/_cat") {
 			fmt.Println(string(raw))
 		} else {
 		pageJsonOutput(conf, raw)
 	}
 	}
 	//nolint:nilerr
 	return nil
@@ -223,10 +216,8 @@ func CallAPI(conf *cfg.Config, verb, path, data string) ([]byte, error) {
 		return nil, err
 	}
 	if !conf.HumanCat || (conf.HumanCat && !strings.HasPrefix(path, "/_cat")) {
 	req.Header.Add("Content-Type", "application/json")
 	req.Header.Add("Accept", "application/json")
 	}
 	// make sure we have got all we need
 	if err := conf.DefaultCluster.CheckAuth(); err != nil {
@@ -280,8 +271,7 @@ func prettyfiJson(conf *cfg.Config, raw []byte) (string, error) {
 	err := json.Indent(&pretty, raw, "", "\t")
 	if err != nil {
-		//nolint:nilerr
+		return "", fmt.Errorf("json parse error: %w", err)
 		return string(raw), nil
 	}
 	return pretty.String(), nil
--- a/pkg/es/index.go
+++ b/pkg/es/index.go
@@ -18,8 +18,6 @@ package es
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"regexp"
@@ -30,7 +28,6 @@ import (
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/healthstatus"
@@ -309,79 +306,3 @@ func IndexFields(conf *cfg.Config, index string) error {
 	return nil
 }
 type Diskusage struct {
 	Total       int64 `json:"total_in_bytes"`
 	Points      int64 `json:"points_in_bytes"`
 	Norms       int64 `json:"norms_in_bytes"`
 	TermVectors int64 `json:"term_vectors_in_bytes"`
 	KnnVectors  int64 `json:"knn_vectors_in_bytes"`
 	BloomFilter int64 `json:"bloom_filter_in_bytes"`
 }
 type IndexDiskUsage struct {
 	AllFields Diskusage            `json:"all_fields"`
 	Fields    map[string]Diskusage `json:"fields"`
 }
 type ResIndexDiskUsage map[string]IndexDiskUsage
 func IndexDiskusage(conf *cfg.Config, index string) error {
 	var bold = lipgloss.NewStyle().Bold(true)
 	res, err := conf.DefaultCluster.ES().Indices.DiskUsage(index).
 		RunExpensiveTasks(true).
 		Do(context.Background())
 	if err != nil {
 		return fmt.Errorf("failed to retrieve index disk usage: %w", esErrorString(err))
 	}
 	duRes := ResIndexDiskUsage{}
 	if err := json.Unmarshal(res, &duRes); err != nil {
 		return fmt.Errorf("failed to unmarshal disk usage response: %w", err)
 	}
 	diskusage, exists := duRes[index]
 	if !exists {
 		return errors.New("no disk usage reported for index")
 	}
 	table := printer.NewTableEmpty(conf).
 		WithHeaders("field", "bloom filter", "norms", "points", "term vectors", "knn vectors", "total")
 	for name, field := range diskusage.Fields {
 		if strings.HasPrefix(name, "_") || strings.HasSuffix(name, ".keyword") {
 			continue
 		}
 		table.AddRow(
 			name,
 			printer.Bytes(field.BloomFilter),
 			printer.Bytes(field.Norms),
 			printer.Bytes(field.Points),
 			printer.Bytes(field.TermVectors),
 			printer.Bytes(field.KnnVectors),
 			printer.Bytes(field.Total),
 		)
 	}
 	all := diskusage.AllFields
 	table.Sort()
 	table.AddRowLate(
 		bold.Render("Summary"),
 		printer.Bytes(all.BloomFilter),
 		printer.Bytes(all.Norms),
 		printer.Bytes(all.Points),
 		printer.Bytes(all.TermVectors),
 		printer.Bytes(all.KnnVectors),
 		printer.Bytes(all.Total),
 	)
 	if err := table.Print(); err != nil {
 		return err
 	}
 	return nil
 }
--- a/pkg/es/node.go
+++ b/pkg/es/node.go
@@ -26,6 +26,7 @@ import (
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/dustin/go-humanize"
 )
 func NodeList(conf *cfg.Config) error {
@@ -37,11 +38,11 @@ func NodeList(conf *cfg.Config) error {
 	slog.Debug("ES result", "nodes", nodes)
-	table := printer.NewTableEmpty(conf).WithHeaders(
+	table := printer.NewTable(conf, 7, len(nodes))
-		"name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
+	table.Addheaders("name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
-	for _, node := range nodes {
+	for idx, node := range nodes {
-		table.AddRow(
+		table.Entries[idx] = []any{
 			*node.Name,
 			*node.Ip,
 			*node.Load1M,
@@ -49,7 +50,7 @@ func NodeList(conf *cfg.Config) error {
 			*node.Load15M,
 			node.RamPercent,
 			node.HeapPercent,
-		)
+		}
 	}
 	table.Sort()
@@ -113,27 +114,18 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 		}
 		k8snode := info.Attributes["k8s_node_name"]
 		rank := "none"
 		adsel, exists := stat.AdaptiveSelection[id]
 		if exists {
 			rank = *adsel.Rank
 		}
 		table.Entries = [][]any{
 			{"Id", id},
 			{"Name", nodename},
 			{"Kubernetes node", k8snode},
 			{"Ip address", info.Ip},
-			{"Node rank", rank},
+			{"Node rank", *stat.AdaptiveSelection[id].Rank},
 			{"JVM", info.Jvm.VmName + " " + info.Jvm.Version},
 			{"JVM Started", time.UnixMilli(info.Jvm.StartTimeInMillis)},
 			{"OS", info.Os.PrettyName + " " + info.Os.Version},
 			{"Node roles", roles},
 			{"Node version", info.Version},
 			// FIXME: not implemented upstream
 			// see: https://github.com/elastic/go-elasticsearch/issues/1526
 			// {"Allocated shards", stat.Allocations.XXX},
 			{"HTTP clients", *stat.Http.CurrentOpen},
 			{"CPUs", *info.Os.AllocatedProcessors},
 			{"Load 15m/5m/1m", fmt.Sprintf("%.2f/%.2f/%.2f",
@@ -142,41 +134,18 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 				stat.Os.Cpu.LoadAverage["1m"],
 			)},
 			{"Open FD's", *stat.Process.OpenFileDescriptors},
-			{"HTTP sesssions current/total", fmt.Sprintf("%d/%d",
+			{"Response time avg", fmt.Sprintf("%dns", *stat.AdaptiveSelection[id].AvgResponseTimeNs)},
 				*stat.Http.CurrentOpen,
 				*stat.Http.TotalOpened,
 			)},
 			{"Traffic rx/tx",
 				printer.ByteString(*stat.Transport.RxSizeInBytes) + " / " + printer.ByteString(*stat.Transport.TxSizeInBytes)},
 			{"Response time avg", time.Duration(*stat.AdaptiveSelection[id].AvgResponseTimeNs)},
 			{"Memory usage (used/avail)",
-				printer.ByteString(*stat.Os.Mem.UsedInBytes) + " / " + printer.ByteString(*stat.Os.Mem.TotalInBytes)},
+				humanize.Bytes(uint64(*stat.Os.Mem.UsedInBytes)) + " / " + humanize.Bytes(uint64(*stat.Os.Mem.TotalInBytes))},
 			{"Search queries current/total", fmt.Sprintf("%d/%d",
 				stat.Indices.Search.QueryCurrent,
 				stat.Indices.Search.QueryTotal,
 			)},
 			{"Search efficiency", stat.Indices.Search.QueryTimeInMillis / stat.Indices.Search.QueryTotal},
 			{"Docs count", stat.Indices.Docs.Count},
 			{"Merges current/total", fmt.Sprintf("%d/%d",
 				stat.Indices.Merges.Current,
 				stat.Indices.Merges.Total,
 			)},
 			{"Merge docs count current/total", fmt.Sprintf("%d/%d",
 				stat.Indices.Merges.CurrentDocs,
 				stat.Indices.Merges.TotalDocs,
 			)},
 			{"Merge size current/total", fmt.Sprintf("%s/%s",
 				printer.ByteString(stat.Indices.Merges.CurrentSizeInBytes),
 				printer.ByteString(stat.Indices.Merges.TotalSizeInBytes),
 			)},
 			{"CircuitBreaker trip count", *stat.Breakers["fielddata"].Tripped},
 		}
 		if len(stat.Fs.Data) > 0 {
 			fs := stat.Fs.Data[0]
-			table.AddRow("Storage usage (used/avail)",
+			table.Entries = append(table.Entries, [][]any{
-				printer.ByteString(*fs.AvailableInBytes)+" / "+printer.ByteString(*fs.TotalInBytes))
+				{"Storage usage (used/avail)",
-			table.AddRow("Storage mount", *fs.Mount)
+					humanize.Bytes(uint64(*fs.AvailableInBytes)) + " / " + humanize.Bytes(uint64(*fs.TotalInBytes))},
 				{"Storage mount", *fs.Mount},
 			}...)
 		}
 		if err := table.Print(); err != nil {
@@ -235,72 +204,3 @@ func NodeClients(conf *cfg.Config, nodename string) error {
 	return table.Print()
 }
 func NodeUsage(conf *cfg.Config, nodeid string) error {
 	usage := conf.DefaultCluster.ES().Nodes.Usage()
 	if nodeid != "" {
 		usage.NodeId(nodeid)
 	}
 	stats, err := usage.Do(context.Background())
 	if err != nil {
 		return fmt.Errorf("failed to get node usage: %w", esErrorString(err))
 	}
 	slog.Debug("ES result", "usage", stats)
 	table := printer.NewTableEmpty(conf).WithHeaders(
 		"node",
 		"bulk",
 		"doc get",
 		"doc mget",
 		"doc update",
 		"index doc",
 		"index stats",
 		"search",
 		"msearch",
 		"open pit",
 	)
 	for id, actions := range stats.Nodes {
 		node, err := getNodeName(conf, id)
 		if err != nil {
 			return err
 		}
 		stat := actions.RestActions
 		table.AddRow(
 			node,
 			stat["bulk_action"],
 			stat["document_get_action"],
 			stat["document_mget_action"],
 			stat["document_update_action"],
 			stat["document_index_action"],
 			stat["indices_stats_action"],
 			stat["search_action"],
 			stat["msearch_action"],
 			stat["open_point_in_time"],
 		)
 	}
 	return table.Print()
 }
 func getNodeName(conf *cfg.Config, id string) (string, error) {
 	res, err := conf.DefaultCluster.ES().Nodes.Info().
 		Metric("os").
 		Do(context.Background())
 	if err != nil {
 		return "", fmt.Errorf("failed to get node info: %w", esErrorString(err))
 	}
 	for nodeid, node := range res.Nodes {
 		if id == nodeid {
 			return node.Name, nil
 		}
 	}
 	return "", nil
 }
--- a/pkg/es/searchql.go
+++ b/pkg/es/searchql.go
@@ -1,79 +0,0 @@
 /*
 Copyright © 2026 Thomas von Dein
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
 package es
 import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"log/slog"
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 )
 type searchQlColumn struct {
 	Name string `json:"name"`
 	Type string `json:"type"`
 }
 type searchQlResult struct {
 	Partial bool             `json:"is_partial"`
 	Docs    int              `json:"documents_found"`
 	Columns []searchQlColumn `json:"columns"`
 	Values  [][]any          `json:"values"`
 }
 func SearchQL(conf *cfg.Config, querystring string) error {
 	query := conf.DefaultCluster.ES().Esql.Query().
 		Query(querystring).
 		DropNullColumns(true)
 	res, err := query.Do(context.Background())
 	if err != nil {
 		return fmt.Errorf("failed to run esql query: %w", esErrorString(err))
 	}
 	if conf.Debug {
 		fmt.Println(string(res))
 	}
 	qlResult := searchQlResult{}
 	if err = json.Unmarshal(res, &qlResult); err != nil {
 		return fmt.Errorf("failed to unmarshal esql result: %w", err)
 	}
 	slog.Debug("searchql result", "qlres", qlResult)
 	if qlResult.Docs == 0 {
 		return nil
 	}
 	table := printer.NewTable(conf, len(qlResult.Columns), len(qlResult.Values))
 	headers := make([]string, len(qlResult.Columns))
 	for idx, col := range qlResult.Columns {
 		headers[idx] = col.Name
 	}
 	table.Addheaders(headers...)
 	table.Entries = qlResult.Values
 	return table.Print()
 }
--- a/pkg/es/shard.go
+++ b/pkg/es/shard.go
@@ -163,35 +163,28 @@ func ShardAllocation(conf *cfg.Config, index string) error {
 	slog.Debug("ES result", "explain", res)
 	currentNode := res.CurrentNode
 	table := printer.NewTable(conf, 2, 10)
 	table.Addheaders("shard allocation setting", "value")
 	table.Entries = [][]any{
 		{"Index", index},
 		{"Current state", res.CurrentState},
 		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
 		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
 		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
 	}
 	if res.CurrentNode != nil {
 		currentNode := res.CurrentNode
 	roles := make([]string, len(currentNode.Roles))
 	for idx, role := range currentNode.Roles {
 		roles[idx] = role.Name
 	}
-		table.Entries = append(table.Entries, [][]any{
+	table.Entries = [][]any{
 		{"Index", index},
 		{"Current state", res.CurrentState},
 		{"Current node", currentNode.Name},
 		{"Current k8s node", currentNode.Attributes["k8s_node_name"]},
 		{"Current node address", currentNode.TransportAddress},
 		{"Current node id", currentNode.Id},
 		{"Current node weight", currentNode.WeightRanking},
 		{"Current node roles", roles},
-		}...)
+		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
-	} else {
+		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
-		table.AddRow("Current node", "not currently assigned to any node")
+		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
 	}
 	if res.CurrentState == "unassigned" {
--- a/pkg/printer/bytes.go
+++ b/pkg/printer/bytes.go
@@ -22,16 +22,10 @@ type ByteSize struct {
 	size uint64
 }
 func Bytes(size int64) ByteSize {
 	return ByteSize{size: uint64(size)}
 }
 func (b *ByteSize) String() string {
 	return humanize.Bytes(b.size)
 }
 func Bytes(size int64) *ByteSize {
 	return &ByteSize{size: uint64(size)}
 }
 func ByteString(size int64) string {
 	b := ByteSize{size: uint64(size)}
 	return b.String()
 }
--- a/pkg/printer/cast.go
+++ b/pkg/printer/cast.go
@@ -38,18 +38,12 @@ func any2string(in any) string {
 		return strconv.Itoa(val)
 	case float64:
 		return fmt.Sprintf("%.2f", val)
 	case float32:
 		return fmt.Sprintf("%.2f", val)
 	case []string:
 		return strings.Join(val, ",")
 	case ByteSize:
 		return val.String()
 	case *ByteSize:
 		return val.String()
 	case time.Time:
 		return val.Format("2006-01-02 15:04:05")
 	case time.Duration:
 		return val.String()
 	case []byte:
 		return string(val)
 	case nil:
--- a/pkg/printer/table.go
+++ b/pkg/printer/table.go
@@ -32,7 +32,6 @@ import (
 type Table struct {
 	Mode    string // tsv, json, yaml
 	Headers []string
 	RawHeaders []string
 	Entries [][]any
 	rows       [][]string // representation used for printing
@@ -46,7 +45,6 @@ func NewTable(conf *cfg.Config, columns, rows int) *Table {
 	table := Table{Mode: conf.Output, maxwidth: cfg.GetTermWidth()}
 	table.Headers = make([]string, columns)
 	table.RawHeaders = make([]string, columns)
 	table.Entries = make([][]any, rows)
 	table.lenHeaders = make([]int, columns)
 	table.alignInts = conf.AlignInts
@@ -67,7 +65,6 @@ func (table *Table) WithHeaders(headers ...string) *Table {
 	table.Entries = [][]any{}
 	table.lenHeaders = make([]int, count)
 	table.Headers = make([]string, count)
 	table.RawHeaders = make([]string, count)
 	table.Addheaders(headers...)
@@ -80,8 +77,6 @@ func (table *Table) Print() error {
 		return table.PrintJSON()
 	case "yaml":
 		return table.PrintYAML()
 	case "csv":
 		return table.PrintCSV()
 	default:
 		return table.PrintTSV()
 	}
@@ -183,28 +178,6 @@ func (table *Table) PrintTSV() error {
 	return nil
 }
 func (table *Table) PrintCSV() error {
 	table.preprocessRows()
 	fmt.Println(strings.Join(table.RawHeaders, ","))
 	for _, entries := range table.rows {
 		row := make([]string, len(entries))
 		for idx, entry := range entries {
 			if strings.Contains(entry, " ") || strings.Contains(entry, ",") {
 				row[idx] = `"` + entry + `"`
 			} else {
 				row[idx] = entry
 			}
 		}
 		fmt.Println(strings.Join(row, ","))
 	}
 	return nil
 }
 func (table *Table) Sort() {
 	// sanity checks
 	if len(table.Entries) == 0 {
@@ -226,8 +199,6 @@ func (table *Table) Addheaders(headers ...string) {
 		default:
 			table.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
 		}
 		table.RawHeaders[idx] = header
 	}
 }
@@ -235,22 +206,6 @@ func (table *Table) AddRow(fields ...any) {
 	table.Entries = append(table.Entries, fields)
 }
 func (table *Table) AddRowLate(fields ...any) {
 	table.AddRow(fields)
 	if !table.processed {
 		return
 	}
 	row := make([]string, len(fields))
 	for idx, field := range fields {
 		row[idx] = any2string(field)
 	}
 	table.rows = append(table.rows, row)
 }
 // needed for json and yaml output
 func (table *Table) toMap() []map[string]any {
 	raw := make([]map[string]any, len(table.Entries))
Author	SHA1	Message	Date
Thomas von Dein	0902b44780	always show actions	2026-07-08 10:20:02 +02:00
Thomas von Dein	5e569b91fc	fix transport http headers	2026-07-08 10:19:48 +02:00
Thomas von Dein	82c6d2e7bb	show green and failed indices in status, rename red to failed in index ls	2026-07-08 09:57:39 +02:00