add esql sample

see: https://github.com/urfave/cli/issues/2348

.golangci.yml

@@ -0,0 +1,110 @@
+version: "2"
+
+linters:
+  enable:
+    - errcheck
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - arangolint
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - canonicalheader
+    - clickhouselint
+    - containedctx
+    #- contextcheck
+    - copyloopvar
+    #- cyclop
+    - decorder
+    - dogsled
+    - dupword
+    - durationcheck
+    - embeddedstructfieldcheck
+    - errchkjson
+    - errname
+    #- errorlint
+    - exhaustive
+    - exptostd
+    - fatcontext
+    - funcorder
+    #- funlen
+    - ginkgolinter
+    - gocheckcompilerdirectives
+    - gochecknoinits
+    - gochecksumtype
+    #- gocognit
+    - gocritic
+    #- gocyclo
+    #- godoclint
+    - goheader
+    - gomoddirectives
+    - gomodguard_v2
+    - goprintffuncname
+    #- gosec
+    - gosmopolitan
+    - grouper
+    - iface
+    - importas
+    - inamedparam
+    - interfacebloat
+    - intrange
+    - iotamixing
+    - lll
+    - loggercheck
+    - makezero
+    - misspell
+    - modernize
+    - nakedret
+    #- nestif
+    - nilerr
+    - nilnesserr
+    - nlreturn
+    - nonamedreturns
+    - nosprintfhostport
+    - paralleltest
+    - perfsprint
+    - prealloc
+    #- predeclared
+    - promlinter
+    - protogetter
+    - reassign
+    - recvcheck
+    #- revive
+    - rowserrcheck
+    - sloglint
+    - spancheck
+    - sqlclosecheck
+    - tagalign
+    - testableexamples
+    - testifylint
+    - testpackage
+    - thelper
+    - tparallel
+    - unconvert
+    - unparam
+    - unqueryvet
+    - usestdlibvars
+    - usetesting
+    - varnamelen
+    - wastedassign
+    - whitespace
+    - wsl_v5
+    - zerologlint
+
+  settings:
+    varnamelen:
+      ignore-names:
+        - err
+        - wg
+        - mu
+        - ts
+        - to
+        - es
+        - op
+        - fd
+        - id
+        - fn
+      

.woodpecker/build.yaml

@@ -2,7 +2,7 @@ matrix:
   platform:
     - linux/amd64
   goversion:
-    - 1.25.8
+    - 1.26.4
 
 labels:
   platform: ${platform}
@@ -21,6 +21,6 @@ steps:
       event: [push,manual]
     image: golang:${goversion}
     commands:
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.5.0
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.2
       - golangci-lint --version
       - golangci-lint run ./...

Makefile

@@ -67,11 +67,11 @@ test: clean buildlocal
 
 testlint: test lint
 
-lint:
+lint-basic:
-	golangci-lint run
+	golangci-lint run --enable-only errcheck,govet,ineffassign,staticcheck,unused
 
-lint-full:
+lint:
-	golangci-lint run --enable-all --exclude-use-default --disable exhaustivestruct,exhaustruct,depguard,interfacer,deadcode,golint,structcheck,scopelint,varcheck,ifshort,maligned,nosnakecase,godot,funlen,gofumpt,cyclop,noctx,gochecknoglobals,paralleltest
+	golangci-lint run --show-stats=false
 
 testfuzzy: clean
 	go test -fuzz ./... $(ARGS)

README.md

@@ -29,6 +29,7 @@ Features:
   logical condition (OR, AND), use PIT, limit datetime (ES date math
   can be used), etc. It is however not yet possible to create
   recursive searches like: `(cond1 AND cond2) OR (cond3 OR cond4)`.
+- Search using ES|QL language: `esctl searchql`.
 - Cross cluster replication (ccr): view, pause, resume, delete
   replication. You can also manage follower configuration.
 - Index management: manage aliases, create, modify, delete indices,
@@ -352,6 +353,30 @@ $ esctl search -i foo* -F title=zeitbuchung message=pause | jq
 }
 ```
 
+You can also search using [ES|QL](https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started):
+
+```console
+$ esctl searchql "from hyperdrive | sort @timestamp | limit 5" 
+@TIMESTAMP                MESSAGE     TAG
+2026-06-24T08:24:56.000Z  arosu       loop
+2026-06-24T08:24:58.000Z  hami        loop
+2026-06-24T08:24:59.000Z  ishininu    loop
+2026-06-24T08:25:00.000Z  uyomoruron  loop
+2026-06-24T08:25:02.000Z  ishimime    loop
+```
+
+There are several output modes (json, yaml, csv), to get esql output as CSV:
+
+```console
+$ esctl searchql "from hyperdrive | sort @timestamp | limit 5"  -o csv
+@timestamp,message,tag
+2026-06-24T08:24:56.000Z,arosu,loop
+2026-06-24T08:24:58.000Z,hami,loop
+2026-06-24T08:24:59.000Z,ishininu,loop
+2026-06-24T08:25:00.000Z,uyomoruron,loop
+2026-06-24T08:25:02.000Z,ishimime,loop
+```
+
 To check which field mappings are available for an index:
 ```console
 $ esctl index show foo2 
@@ -538,6 +563,7 @@ index                       - manage indicies
   close                     - close an index
   fields                    - show info about field capabilities
   ilm                       - show ilm status
+  du                        - show index disk usage
   alias                     - manage index aliases
     create                  - create an index alias
     list                    - list index aliases
@@ -555,6 +581,7 @@ node                        - manage nodes
   list                      - list nodes
   show                      - show details about a node
   clients                   - show node http clients
+  usage                     - show node usage stats
 role                        - manage roles
   list                      - list roles
   show                      - show details about a role
@@ -574,6 +601,7 @@ version                     - show esctl version information
 debug                       - developer only
 help-jsonpath               - show jsonpath help
 help-usage                  - show overview of all available commands
+help-esql                   - show esql help
 ```
 
 # Development

assets/assets.go

@@ -24,10 +24,11 @@ import (
 	"github.com/go-openapi/swag/loading"
 )
 
-//go:embed *.json
+//go:embed *.json *.md
 var AssetFS embed.FS
 
 var OpenAPI *loads.Document
+var EsQlCheatSheet string
 
 func LoadAssetOpenApi() {
 	doc, err := loads.Spec(
@@ -41,3 +42,12 @@ func LoadAssetOpenApi() {
 
 	OpenAPI = doc
 }
+
+func LoadEsql() {
+	md, err := AssetFS.ReadFile("esql.md")
+	if err != nil {
+		panic(err)
+	}
+
+	EsQlCheatSheet = string(md)
+}

assets/esql.md

@@ -0,0 +1,951 @@
+<!-- courtesy https://github.com/linkan-per/ES-QL-Cheat-Sheet by |linkan-per -->
+# ES|QL (Elasticsearch Query Language) Cheat Sheet
+
+## Table of Contents
+1. [Introduction](#introduction)
+2. [Basic Query Structure](#basic-query-structure)
+3. [Source Commands](#source-commands)
+4. [Processing Commands](#processing-commands)
+5. [Data Selection & Filtering](#data-selection--filtering)
+6. [Aggregations & Statistics](#aggregations--statistics)
+7. [String Functions](#string-functions)
+8. [Mathematical Functions](#mathematical-functions)
+9. [Date/Time Functions](#datetime-functions)
+10. [Type Conversion Functions](#type-conversion-functions)
+11. [Conditional Functions](#conditional-functions)
+12. [Array Functions](#array-functions)
+13. [Join Operations (LOOKUP)](#join-operations-lookup)
+14. [Sorting & Limiting](#sorting--limiting)
+15. [Grouping & Aggregating](#grouping--aggregating)
+16. [Advanced Patterns](#advanced-patterns)
+
+---
+
+## Introduction
+
+ES|QL is Elasticsearch's new query language designed for data exploration, analysis, and transformation. It uses a pipe (`|`) syntax to chain commands together.
+
+**Basic Syntax:**
+```
+FROM <data-source>
+| <processing-command>
+| <processing-command>
+| ...
+```
+
+---
+
+## Basic Query Structure
+
+### Simple Query
+```esql
+FROM logs-*
+| LIMIT 10
+```
+
+### Query with Multiple Commands
+```esql
+FROM employees
+| WHERE department == "Engineering"
+| KEEP name, salary, hire_date
+| SORT salary DESC
+| LIMIT 5
+```
+
+---
+
+## Source Commands
+
+### FROM - Specify Data Source
+```esql
+// From a single index
+FROM logs-2024
+
+// From multiple indices with wildcard
+FROM logs-*, metrics-*
+
+// From specific indices
+FROM index1, index2, index3
+
+// With metadata
+FROM logs-* METADATA _id, _index
+```
+
+### ROW - Generate Inline Data
+```esql
+// Create a single row
+ROW name = "John", age = 30, city = "NYC"
+
+// Multiple rows
+ROW a = 1, b = "x"
+| EVAL c = a * 10
+```
+
+---
+
+## Processing Commands
+
+### KEEP - Select Specific Fields
+```esql
+FROM employees
+| KEEP name, department, salary
+
+// Keep with pattern
+FROM logs-*
+| KEEP @timestamp, message, host.*
+```
+
+### DROP - Remove Specific Fields
+```esql
+FROM employees
+| DROP password, ssn, internal_notes
+
+// Drop with pattern
+FROM logs-*
+| DROP *.keyword
+```
+
+### RENAME - Rename Fields
+```esql
+FROM employees
+| RENAME emp_name AS name, emp_dept AS department
+
+// Multiple renames
+FROM logs-*
+| RENAME source.ip AS src_ip, destination.ip AS dst_ip
+```
+
+---
+
+## Data Selection & Filtering
+
+### WHERE - Filter Rows
+```esql
+// Equality
+FROM employees
+| WHERE department == "Sales"
+
+// Comparison operators
+FROM products
+| WHERE price > 100 AND stock < 50
+
+// IS NULL / IS NOT NULL
+FROM logs-*
+| WHERE error_code IS NOT NULL
+
+// IN operator
+FROM employees
+| WHERE department IN ("Sales", "Marketing", "HR")
+
+// LIKE operator (wildcards)
+FROM logs-*
+| WHERE message LIKE "*error*"
+
+// RLIKE operator (regex)
+FROM logs-*
+| WHERE message RLIKE "error|exception|failure"
+
+// NOT operator
+FROM employees
+| WHERE NOT department == "IT"
+
+// Multiple conditions
+FROM orders
+| WHERE status == "completed" 
+  AND total_amount > 1000 
+  AND order_date >= "2024-01-01"
+```
+
+---
+
+## Aggregations & Statistics
+
+### STATS - Aggregate Functions
+
+#### COUNT
+```esql
+// Count all rows
+FROM logs-*
+| STATS count = COUNT()
+
+// Count distinct
+FROM employees
+| STATS unique_departments = COUNT_DISTINCT(department)
+
+// Count by group
+FROM logs-*
+| STATS event_count = COUNT() BY log_level
+```
+
+#### SUM, AVG, MIN, MAX
+```esql
+FROM sales
+| STATS 
+    total_revenue = SUM(amount),
+    avg_sale = AVG(amount),
+    min_sale = MIN(amount),
+    max_sale = MAX(amount)
+
+// With grouping
+FROM sales
+| STATS 
+    total = SUM(amount),
+    average = AVG(amount)
+  BY product_category
+```
+
+#### MEDIAN, PERCENTILE
+```esql
+FROM response_times
+| STATS 
+    median_time = MEDIAN(duration),
+    p95 = PERCENTILE(duration, 95),
+    p99 = PERCENTILE(duration, 99)
+```
+
+#### Multiple Aggregations
+```esql
+FROM orders
+| STATS 
+    order_count = COUNT(),
+    total_revenue = SUM(amount),
+    avg_order_value = AVG(amount),
+    unique_customers = COUNT_DISTINCT(customer_id)
+  BY region, product_category
+```
+
+---
+
+## String Functions
+
+### CONCAT - Concatenate Strings
+```esql
+FROM employees
+| EVAL full_name = CONCAT(first_name, " ", last_name)
+
+// With separator
+FROM logs-*
+| EVAL log_info = CONCAT(level, ": ", message)
+```
+
+### SUBSTRING - Extract Substring
+```esql
+FROM employees
+| EVAL first_initial = SUBSTRING(first_name, 0, 1)
+
+// Extract with length
+FROM products
+| EVAL short_code = SUBSTRING(product_id, 0, 5)
+```
+
+### LENGTH - String Length
+```esql
+FROM messages
+| EVAL message_length = LENGTH(message)
+| WHERE message_length > 100
+```
+
+### TRIM, LTRIM, RTRIM - Remove Whitespace
+```esql
+FROM user_input
+| EVAL cleaned = TRIM(input_field)
+| EVAL left_trimmed = LTRIM(input_field)
+| EVAL right_trimmed = RTRIM(input_field)
+```
+
+### UPPER, LOWER - Case Conversion
+```esql
+FROM employees
+| EVAL name_upper = UPPER(name)
+| EVAL email_lower = LOWER(email)
+```
+
+### REPLACE - Replace String
+```esql
+FROM logs-*
+| EVAL cleaned_message = REPLACE(message, "ERROR", "Warning")
+```
+
+### SPLIT - Split String into Array
+```esql
+FROM logs-*
+| EVAL tags_array = SPLIT(tags, ",")
+```
+
+### STARTS_WITH, ENDS_WITH
+```esql
+FROM files
+| WHERE STARTS_WITH(filename, "log_")
+| WHERE ENDS_WITH(filename, ".txt")
+```
+
+---
+
+## Mathematical Functions
+
+### Basic Operations
+```esql
+FROM sales
+| EVAL 
+    total = price * quantity,
+    discount_price = price * 0.9,
+    tax = price * 0.08
+
+// Multiple operations
+FROM metrics
+| EVAL 
+    sum_val = field1 + field2,
+    diff_val = field1 - field2,
+    product = field1 * field2,
+    ratio = field1 / field2,
+    remainder = field1 % field2
+```
+
+### ABS - Absolute Value
+```esql
+FROM transactions
+| EVAL abs_amount = ABS(transaction_amount)
+```
+
+### ROUND, FLOOR, CEIL
+```esql
+FROM measurements
+| EVAL 
+    rounded = ROUND(value, 2),
+    floored = FLOOR(value),
+    ceiled = CEIL(value)
+```
+
+### POW - Power
+```esql
+FROM data
+| EVAL squared = POW(value, 2)
+| EVAL cubed = POW(value, 3)
+```
+
+### SQRT - Square Root
+```esql
+FROM measurements
+| EVAL sqrt_value = SQRT(value)
+```
+
+### LOG, LOG10
+```esql
+FROM data
+| EVAL 
+    natural_log = LOG(value),
+    log_base_10 = LOG10(value)
+```
+
+### GREATEST, LEAST
+```esql
+FROM comparisons
+| EVAL 
+    max_val = GREATEST(val1, val2, val3),
+    min_val = LEAST(val1, val2, val3)
+```
+
+---
+
+## Date/Time Functions
+
+### NOW - Current Timestamp
+```esql
+FROM logs-*
+| EVAL current_time = NOW()
+```
+
+### DATE_EXTRACT - Extract Date Parts
+```esql
+FROM events
+| EVAL 
+    year = DATE_EXTRACT("year", @timestamp),
+    month = DATE_EXTRACT("month", @timestamp),
+    day = DATE_EXTRACT("day", @timestamp),
+    hour = DATE_EXTRACT("hour", @timestamp),
+    minute = DATE_EXTRACT("minute", @timestamp),
+    day_of_week = DATE_EXTRACT("day_of_week", @timestamp)
+```
+
+### DATE_FORMAT - Format Date
+```esql
+FROM events
+| EVAL formatted_date = DATE_FORMAT("yyyy-MM-dd", @timestamp)
+| EVAL custom_format = DATE_FORMAT("MMM dd, yyyy HH:mm", @timestamp)
+```
+
+### DATE_TRUNC - Truncate Date
+```esql
+FROM logs-*
+| EVAL 
+    hour_bucket = DATE_TRUNC("hour", @timestamp),
+    day_bucket = DATE_TRUNC("day", @timestamp),
+    month_bucket = DATE_TRUNC("month", @timestamp)
+```
+
+### DATE_DIFF - Date Difference
+```esql
+FROM orders
+| EVAL days_since_order = DATE_DIFF("days", order_date, NOW())
+| EVAL hours_to_delivery = DATE_DIFF("hours", order_date, delivery_date)
+```
+
+### DATE_PARSE - Parse String to Date
+```esql
+FROM data
+| EVAL parsed_date = DATE_PARSE("yyyy-MM-dd", date_string)
+```
+
+---
+
+## Type Conversion Functions
+
+### TO_STRING - Convert to String
+```esql
+FROM data
+| EVAL id_string = TO_STRING(id)
+| EVAL amount_string = TO_STRING(amount)
+```
+
+### TO_INTEGER, TO_LONG - Convert to Integer
+```esql
+FROM data
+| EVAL age_int = TO_INTEGER(age_string)
+| EVAL id_long = TO_LONG(id_string)
+```
+
+### TO_DOUBLE - Convert to Double
+```esql
+FROM data
+| EVAL price_double = TO_DOUBLE(price_string)
+```
+
+### TO_BOOLEAN - Convert to Boolean
+```esql
+FROM data
+| EVAL is_active = TO_BOOLEAN(active_string)
+```
+
+### TO_DATETIME - Convert to DateTime
+```esql
+FROM data
+| EVAL timestamp = TO_DATETIME(date_string)
+```
+
+### TO_IP - Convert to IP Address
+```esql
+FROM logs-*
+| EVAL ip_address = TO_IP(ip_string)
+```
+
+---
+
+## Conditional Functions
+
+### CASE - Conditional Logic
+```esql
+FROM employees
+| EVAL salary_grade = CASE(
+    salary < 50000, "Entry",
+    salary < 80000, "Mid",
+    salary < 120000, "Senior",
+    "Executive"
+  )
+
+// With multiple conditions
+FROM orders
+| EVAL order_status = CASE(
+    status == "pending" AND days_old > 7, "Overdue",
+    status == "pending", "Processing",
+    status == "shipped", "In Transit",
+    status == "delivered", "Completed",
+    "Unknown"
+  )
+```
+
+### COALESCE - Return First Non-Null Value
+```esql
+FROM data
+| EVAL display_name = COALESCE(nickname, first_name, username, "Unknown")
+```
+
+### IF - Simple Conditional
+```esql
+FROM products
+| EVAL stock_status = 
+    CASE(stock > 0, "Available", "Out of Stock")
+
+// Nested conditions
+FROM employees
+| EVAL bonus = CASE(
+    performance_rating >= 4.5, salary * 0.15,
+    performance_rating >= 3.5, salary * 0.10,
+    performance_rating >= 2.5, salary * 0.05,
+    0
+  )
+```
+
+---
+
+## Array Functions
+
+### MV_COUNT - Count Array Elements
+```esql
+FROM logs-*
+| EVAL tag_count = MV_COUNT(tags)
+| WHERE tag_count > 3
+```
+
+### MV_AVG, MV_SUM, MV_MIN, MV_MAX - Array Aggregations
+```esql
+FROM metrics
+| EVAL 
+    avg_value = MV_AVG(values),
+    total = MV_SUM(values),
+    min_value = MV_MIN(values),
+    max_value = MV_MAX(values)
+```
+
+### MV_CONCAT - Concatenate Array Elements
+```esql
+FROM logs-*
+| EVAL all_tags = MV_CONCAT(tags, ", ")
+```
+
+### MV_DEDUPE - Remove Duplicates from Array
+```esql
+FROM data
+| EVAL unique_values = MV_DEDUPE(values)
+```
+
+### MV_FIRST, MV_LAST - Get First/Last Element
+```esql
+FROM logs-*
+| EVAL first_tag = MV_FIRST(tags)
+| EVAL last_tag = MV_LAST(tags)
+```
+
+### MV_SLICE - Extract Array Slice
+```esql
+FROM data
+| EVAL first_three = MV_SLICE(values, 0, 3)
+```
+
+---
+
+## Join Operations (LOOKUP)
+
+ES|QL uses ENRICH (similar to LOOKUP/JOIN) to join data from enrich policies.
+
+### Prerequisites: Create Enrich Policy
+First, create an enrich policy in Kibana Dev Tools:
+
+```json
+PUT /_enrich/policy/user_lookup
+{
+  "match": {
+    "indices": "users",
+    "match_field": "user_id",
+    "enrich_fields": ["username", "email", "department"]
+  }
+}
+
+POST /_enrich/policy/user_lookup/_execute
+```
+
+### ENRICH - Join/Lookup Data
+```esql
+FROM logs-*
+| ENRICH user_lookup ON user_id
+| KEEP @timestamp, user_id, username, email, message
+
+// With field renaming
+FROM transactions
+| ENRICH product_lookup ON product_id WITH product_name, category, price
+| KEEP transaction_id, product_name, category, quantity, price
+
+// Multiple enrichments
+FROM orders
+| ENRICH customer_lookup ON customer_id WITH customer_name, customer_tier
+| ENRICH product_lookup ON product_id WITH product_name, product_category
+| KEEP order_id, customer_name, product_name, order_amount
+```
+
+### Complex Join Example
+```esql
+FROM orders
+| ENRICH customer_lookup ON customer_id 
+    WITH customer_name, customer_email, customer_segment
+| ENRICH product_lookup ON product_id 
+    WITH product_name, product_category, product_price
+| EVAL total_price = quantity * product_price
+| WHERE customer_segment == "Premium"
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(total_price)
+  BY customer_name, product_category
+| SORT total_revenue DESC
+```
+
+---
+
+## Sorting & Limiting
+
+### SORT - Order Results
+```esql
+// Ascending order (default)
+FROM employees
+| SORT salary
+
+// Descending order
+FROM employees
+| SORT salary DESC
+
+// Multiple fields
+FROM employees
+| SORT department ASC, salary DESC
+
+// With nulls first/last
+FROM data
+| SORT value DESC NULLS FIRST
+```
+
+### LIMIT - Limit Results
+```esql
+// Get first 10 rows
+FROM logs-*
+| LIMIT 10
+
+// Top 5 highest salaries
+FROM employees
+| SORT salary DESC
+| LIMIT 5
+
+// Pagination (skip and limit)
+FROM products
+| SORT price
+| LIMIT 20  // Results 0-19
+```
+
+### HEAD - Get First N Rows (Alias for LIMIT)
+```esql
+FROM logs-*
+| HEAD 100
+```
+
+---
+
+## Grouping & Aggregating
+
+### GROUP BY with STATS
+```esql
+// Single field grouping
+FROM sales
+| STATS total_sales = SUM(amount) BY region
+
+// Multiple field grouping
+FROM orders
+| STATS 
+    order_count = COUNT(),
+    total_revenue = SUM(amount)
+  BY region, product_category, sales_rep
+
+// Time-based grouping
+FROM logs-*
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS event_count = COUNT() BY hour, log_level
+| SORT hour DESC
+```
+
+### Complex Aggregation Example
+```esql
+FROM sales_data
+| WHERE order_date >= "2024-01-01"
+| EVAL month = DATE_TRUNC("month", order_date)
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(amount),
+    avg_order_value = AVG(amount),
+    unique_customers = COUNT_DISTINCT(customer_id),
+    max_order = MAX(amount),
+    min_order = MIN(amount)
+  BY month, region, product_category
+| EVAL revenue_per_customer = total_revenue / unique_customers
+| WHERE total_orders > 100
+| SORT month DESC, total_revenue DESC
+| LIMIT 50
+```
+
+---
+
+## Advanced Patterns
+
+### Window Functions Pattern
+```esql
+// Running total by group
+FROM sales
+| SORT date
+| STATS 
+    daily_sales = SUM(amount),
+    order_count = COUNT()
+  BY date, region
+| SORT region, date
+```
+
+### Pivoting Data
+```esql
+// Count by status and priority
+FROM tickets
+| STATS ticket_count = COUNT() BY status, priority
+| SORT status, priority
+```
+
+### Finding Duplicates
+```esql
+FROM users
+| STATS count = COUNT() BY email
+| WHERE count > 1
+| SORT count DESC
+```
+
+### Time Series Analysis
+```esql
+FROM metrics-*
+| EVAL 
+    hour = DATE_TRUNC("hour", @timestamp),
+    day = DATE_EXTRACT("day", @timestamp)
+| STATS 
+    avg_cpu = AVG(cpu_percent),
+    max_cpu = MAX(cpu_percent),
+    avg_memory = AVG(memory_percent)
+  BY hour, host
+| WHERE avg_cpu > 80
+| SORT hour DESC
+```
+
+### Percentage Calculations
+```esql
+FROM sales
+| STATS 
+    total_sales = SUM(amount),
+    count = COUNT()
+  BY product_category
+| EVAL percentage = ROUND(total_sales / SUM(total_sales) * 100, 2)
+| SORT percentage DESC
+```
+
+### Top N per Group
+```esql
+// Top 3 products per category by sales
+FROM sales
+| STATS total_sales = SUM(amount) BY product_category, product_name
+| SORT product_category, total_sales DESC
+// Note: ES|QL doesn't have native PARTITION BY, 
+// so you may need to process this in multiple queries or use aggregations
+```
+
+### Data Cleaning
+```esql
+FROM raw_data
+| EVAL 
+    // Clean whitespace
+    cleaned_name = TRIM(name),
+    // Standardize case
+    email_lower = LOWER(email),
+    // Replace values
+    status = REPLACE(status, "N/A", "Unknown"),
+    // Handle nulls
+    age = COALESCE(age, 0),
+    // Validate ranges
+    valid_age = CASE(age < 0 OR age > 150, NULL, age)
+| WHERE cleaned_name IS NOT NULL
+| DROP name, email
+| RENAME cleaned_name AS name, email_lower AS email
+```
+
+### Cohort Analysis
+```esql
+FROM user_events
+| EVAL 
+    signup_month = DATE_TRUNC("month", signup_date),
+    event_month = DATE_TRUNC("month", event_date)
+| STATS 
+    active_users = COUNT_DISTINCT(user_id)
+  BY signup_month, event_month
+| SORT signup_month, event_month
+```
+
+### Anomaly Detection Pattern
+```esql
+FROM metrics-*
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS 
+    avg_value = AVG(value),
+    stddev = SQRT(AVG(POW(value - AVG(value), 2)))
+  BY hour
+| EVAL 
+    upper_bound = avg_value + (2 * stddev),
+    lower_bound = avg_value - (2 * stddev)
+```
+
+---
+
+## Complete Real-World Examples
+
+### Example 1: User Activity Dashboard
+```esql
+FROM user_logs-*
+| WHERE @timestamp >= NOW() - 7 days
+| ENRICH user_lookup ON user_id WITH username, user_tier
+| EVAL day = DATE_TRUNC("day", @timestamp)
+| STATS 
+    daily_active_users = COUNT_DISTINCT(user_id),
+    total_sessions = COUNT(),
+    avg_session_duration = AVG(session_duration)
+  BY day, user_tier
+| EVAL avg_duration_minutes = ROUND(avg_session_duration / 60, 2)
+| SORT day DESC, user_tier
+```
+
+### Example 2: E-commerce Sales Report
+```esql
+FROM orders
+| WHERE order_date >= "2024-01-01"
+| ENRICH customer_lookup ON customer_id 
+    WITH customer_name, customer_segment
+| ENRICH product_lookup ON product_id 
+    WITH product_name, product_category, cost_price
+| EVAL 
+    profit = (price - cost_price) * quantity,
+    month = DATE_TRUNC("month", order_date)
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(price * quantity),
+    total_profit = SUM(profit),
+    avg_order_value = AVG(price * quantity),
+    unique_customers = COUNT_DISTINCT(customer_id)
+  BY month, product_category, customer_segment
+| EVAL profit_margin = ROUND(total_profit / total_revenue * 100, 2)
+| WHERE total_revenue > 10000
+| SORT month DESC, total_revenue DESC
+| LIMIT 100
+```
+
+### Example 3: Security Log Analysis
+```esql
+FROM security-logs-*
+| WHERE @timestamp >= NOW() - 24 hours
+| WHERE event_type IN ("login_failed", "suspicious_activity")
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS 
+    event_count = COUNT(),
+    unique_ips = COUNT_DISTINCT(source_ip),
+    unique_users = COUNT_DISTINCT(username)
+  BY hour, event_type, country
+| WHERE event_count > 100
+| SORT hour DESC, event_count DESC
+```
+
+### Example 4: Application Performance Monitoring
+```esql
+FROM apm-*
+| WHERE @timestamp >= NOW() - 1 hour
+| EVAL 
+    response_category = CASE(
+        response_time < 100, "Fast",
+        response_time < 500, "Medium",
+        response_time < 1000, "Slow",
+        "Very Slow"
+    ),
+    minute = DATE_TRUNC("minute", @timestamp)
+| STATS 
+    request_count = COUNT(),
+    avg_response = AVG(response_time),
+    p95_response = PERCENTILE(response_time, 95),
+    p99_response = PERCENTILE(response_time, 99),
+    error_count = COUNT() WHERE status_code >= 400
+  BY minute, endpoint, response_category
+| EVAL error_rate = ROUND(error_count / request_count * 100, 2)
+| WHERE request_count > 10
+| SORT minute DESC, avg_response DESC
+```
+
+---
+
+## Tips & Best Practices
+
+1. **Use KEEP instead of SELECT** - More explicit about which fields to retain
+2. **Filter early with WHERE** - Reduce data processing by filtering before aggregations
+3. **Use DATE_TRUNC for time bucketing** - Essential for time series analysis
+4. **Leverage ENRICH for joins** - Pre-create enrich policies for frequently joined data
+5. **Use EVAL for calculated fields** - Create derived fields before aggregation
+6. **Combine multiple conditions in WHERE** - More efficient than multiple WHERE clauses
+7. **Use STATS with BY for grouping** - Replaces traditional GROUP BY
+8. **Sort after aggregation** - More efficient than sorting before
+9. **Use LIMIT to control output size** - Especially important for large datasets
+10. **Use metadata fields when needed** - Access _id, _index with METADATA keyword
+
+---
+
+## Common Patterns Cheat Sheet
+
+```esql
+// Count by field
+FROM index | STATS count = COUNT() BY field
+
+// Top N
+FROM index | STATS value = SUM(amount) BY category | SORT value DESC | LIMIT 10
+
+// Time series
+FROM index | EVAL bucket = DATE_TRUNC("hour", @timestamp) | STATS count = COUNT() BY bucket
+
+// Percentage of total
+FROM index | STATS total = SUM(amount) BY category | EVAL pct = total / SUM(total) * 100
+
+// Filter nulls
+FROM index | WHERE field IS NOT NULL
+
+// String matching
+FROM index | WHERE field LIKE "*pattern*"
+
+// Date range
+FROM index | WHERE @timestamp >= NOW() - 7 days
+
+// Multiple aggregations
+FROM index | STATS count = COUNT(), sum = SUM(val), avg = AVG(val) BY group
+
+// Conditional aggregation
+FROM index | STATS error_count = COUNT() WHERE status == "error" BY service
+```
+
+---
+
+## Comparison with Traditional SQL
+
+| SQL | ES|QL |
+|-----|-------|
+| SELECT * | FROM index |
+| SELECT field1, field2 | FROM index \| KEEP field1, field2 |
+| WHERE condition | WHERE condition (same) |
+| GROUP BY field | STATS ... BY field |
+| ORDER BY field | SORT field |
+| LIMIT 10 | LIMIT 10 (same) |
+| COUNT(*) | STATS count = COUNT() |
+| SUM(field) | STATS total = SUM(field) |
+| AVG(field) | STATS avg = AVG(field) |
+| JOIN | ENRICH (using enrich policies) |
+| CASE WHEN | CASE(...) |
+| CONCAT(a, b) | CONCAT(a, b) (same) |
+
+---
+
+## Resources
+
+- Official ES|QL Documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html
+- ES|QL Functions Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-functions.html
+- Enrich Processor: https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html
+
+---
+
+*Last Updated: 2024*
+*ES|QL is actively evolving - check official documentation for latest features*

cmd/api.go

@@ -72,7 +72,7 @@ func ApiShow(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Capi)
+			complete(conf, cmd, Capi)
 		},
 	}
 }
@@ -91,6 +91,12 @@ func ApiRepl(conf *cfg.Config) *cli.Command {
 				Aliases:     []string{"p"},
 				Sources:     cli.EnvVars("PAGER", "ES_JSON_PAGER"),
 			},
+			&cli.BoolFlag{
+				Name:        "human-readable-cat",
+				Usage:       "enable human readable /_cat output",
+				Destination: &conf.HumanCat,
+				Aliases:     []string{"H"},
+			},
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/ccr.go

@@ -59,7 +59,7 @@ func CcrStatus(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Ccluster)
+			complete(conf, cmd, Ccluster)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -115,7 +115,7 @@ func CcrRemoteInfo(conf *cfg.Config) *cli.Command {
 		UsageText: "info [options] [<index>]",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/ccr_follower.go

@@ -60,7 +60,7 @@ func CcrFollowerRenew(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -82,7 +82,7 @@ func CcrFollowerResume(conf *cfg.Config) *cli.Command {
 		UsageText: "resume [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -104,7 +104,7 @@ func CcrFollowerPause(conf *cfg.Config) *cli.Command {
 		UsageText: "pause [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -126,7 +126,7 @@ func CcrFollowerUnfollow(conf *cfg.Config) *cli.Command {
 		UsageText: "unfollow [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -158,7 +158,7 @@ func CcrFollowerAdd(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -181,7 +181,7 @@ func CcrFollowerDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -205,7 +205,7 @@ func CcrFollowerShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/cluster.go

@@ -83,7 +83,7 @@ func ClusterSwitch(conf *cfg.Config) *cli.Command {
 		Aliases:   []string{"ctx"},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Ccluster)
+			complete(conf, cmd, Ccluster)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/cluster_reroute.go

@@ -50,7 +50,7 @@ func ClusterRerouteMove(conf *cfg.Config) *cli.Command {
 		UsageText: "move [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{
@@ -95,7 +95,7 @@ func ClusterRerouteAllocateReplica(conf *cfg.Config) *cli.Command {
 		UsageText: "allocate-replica [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{
@@ -133,7 +133,7 @@ func ClusterRerouteCancel(conf *cfg.Config) *cli.Command {
 		UsageText: "cancel [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{
@@ -177,7 +177,6 @@ func ClusterRerouteAllocatePrimary(conf *cfg.Config, stale bool) *cli.Command {
 	if stale {
 		name = "allocate-stale-primary"
 		usage = "allocate a stale primary shard to a node"
-
 	}
 
 	return &cli.Command{
@@ -186,7 +185,7 @@ func ClusterRerouteAllocatePrimary(conf *cfg.Config, stale bool) *cli.Command {
 		UsageText: name + " [options] <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{

cmd/cluster_settings.go

@@ -105,7 +105,7 @@ func ClusterSettingsSet(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cclustersettings)
+			complete(conf, cmd, Cclustersettings)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/completion.go

@@ -36,20 +36,15 @@ const (
 	Cclustersettings
 )
 
-func complete(cmd *cli.Command, what int) {
+func complete(conf *cfg.Config, cmd *cli.Command, what int) {
 	if cmd.NArg() > 0 {
 		return
 	}
 
-	// FIXME: config should load from root.Before(), see https://github.com/urfave/cli/issues/2348
+	var (
-	// workaround: load it directly here
+		list []string
-	conf := cfg.NewConfig()
+		err  error
-	if err := conf.Init(); err != nil {
+	)
-		return
-	}
-
-	var list []string
-	var err error
 
 	switch what {
 	case Cindex:

cmd/datastream.go

@@ -91,7 +91,7 @@ func DatastreamShow(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -113,7 +113,7 @@ func DatastreamCreate(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -135,7 +135,7 @@ func DatastreamDelete(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -148,7 +148,7 @@ func DatastreamRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <data stream>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{
@@ -205,7 +205,7 @@ func DatastreamIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "ds ilm <name>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/ilm.go

@@ -123,7 +123,7 @@ func IlmShow(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cilm)
+			complete(conf, cmd, Cilm)
 		},
 	}
 }

cmd/ilm_forecast.go

@@ -71,7 +71,7 @@ func IlmForecastList(conf *cfg.Config) *cli.Command {
 			},
 			&cli.StringFlag{
 				Name:        "within",
-				Usage:       "<duration> withing which to forecast",
+				Usage:       "<duration> within which to forecast",
 				Destination: &conf.Ilm.Within,
 				Aliases:     []string{"w"},
 			},
@@ -121,7 +121,7 @@ func IlmForecastShow(conf *cfg.Config) *cli.Command {
 			},
 			&cli.StringFlag{
 				Name:        "within",
-				Usage:       "duration withing which to forecast",
+				Usage:       "duration within which to forecast",
 				Destination: &conf.Ilm.Within,
 				Aliases:     []string{"w"},
 			},

cmd/index.go

@@ -19,7 +19,6 @@ package cmd
 import (
 	"context"
 	"errors"
-	"fmt"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -42,6 +41,7 @@ func Index(conf *cfg.Config) *cli.Command {
 			IndexClose(conf),
 			IndexFields(conf),
 			IndexIlm(conf),
+			IndexDu(conf),
 
 			// sub commands
 			IndexAlias(conf),
@@ -76,10 +76,10 @@ func IndexList(conf *cfg.Config) *cli.Command {
 				Aliases:     []string{"H"},
 			},
 			&cli.BoolFlag{
-				Name:        "reds",
+				Name:        "failed",
 				Usage:       "include only red failed indicies",
 				Destination: &conf.Failed,
-				Aliases:     []string{"r"},
+				Aliases:     []string{"f"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
@@ -111,7 +111,7 @@ func IndexShow(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }
@@ -163,7 +163,7 @@ Valid field mapping types: integer, text, date, keyword`,
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 			if args.Len() == 0 {
-				return fmt.Errorf("no index specified")
+				return errors.New("no index specified")
 			}
 
 			mappings := args.Slice()[1:]
@@ -181,7 +181,7 @@ func IndexDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -202,7 +202,7 @@ func IndexClose(conf *cfg.Config) *cli.Command {
 		UsageText: "close <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -244,7 +244,7 @@ func IndexFields(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -265,7 +265,7 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "index ilm <index>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -278,3 +278,24 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func IndexDu(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "du",
+		Usage:     "show index disk usage",
+		UsageText: "index du <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.IndexDiskusage(conf, index)
+		},
+	}
+}

cmd/index_alias.go

@@ -38,7 +38,8 @@ func IndexAlias(conf *cfg.Config) *cli.Command {
 			IndexAliasDelete(conf),
 			IndexAliasRollover(conf),
 			// FIXME: implement IndexAliasAdd
-			//IndexAliasAdd(conf), // see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
+			// see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
+			// IndexAliasAdd(conf),
 		},
 	}
 }
@@ -51,7 +52,7 @@ func IndexAliasCreate(conf *cfg.Config) *cli.Command {
 		UsageText: "create <index> <alias>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -75,7 +76,7 @@ func IndexAliasDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index> <alias>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -99,7 +100,7 @@ func IndexAliasRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <alias>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 
 		Flags: []cli.Flag{

cmd/index_template.go

@@ -19,7 +19,6 @@ package cmd
 import (
 	"context"
 	"errors"
-	"fmt"
 	"slices"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
@@ -72,7 +71,7 @@ func IndexTemplateShow(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }
@@ -180,7 +179,7 @@ https://www.elastic.co/docs/reference/elasticsearch/index-settings
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 			if args.Len() == 0 {
-				return fmt.Errorf("no name specified")
+				return errors.New("no name specified")
 			}
 
 			if conf.Mode != "" {
@@ -216,7 +215,7 @@ func IndexTemplateDelete(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }

cmd/node.go

@@ -36,6 +36,7 @@ func Node(conf *cfg.Config) *cli.Command {
 			NodeList(conf),
 			NodeShow(conf),
 			NodeClients(conf),
+			NodeUsage(conf),
 		},
 	}
 }
@@ -60,7 +61,7 @@ func NodeShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show [options] <node>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cnode)
+			complete(conf, cmd, Cnode)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -90,7 +91,7 @@ func NodeClients(conf *cfg.Config) *cli.Command {
 		},
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cnode)
+			complete(conf, cmd, Cnode)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -103,3 +104,19 @@ func NodeClients(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func NodeUsage(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "usage",
+		Usage:     "show node usage stats",
+		UsageText: "usage [options] [<node>]",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cnode)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.NodeUsage(conf, cmd.Args().Get(0))
+		},
+	}
+}

cmd/roles.go

@@ -68,7 +68,7 @@ func RoleShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show [options] <role>",
 
 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Crole)
+			complete(conf, cmd, Crole)
 		},
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {

cmd/root.go

@@ -24,16 +24,71 @@ import (
 	"runtime/pprof"
 	"strings"
 
+	"codeberg.org/scip/esctl/assets"
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
+	"codeberg.org/scip/esctl/pkg/printer"
 
+	markdown "github.com/MichaelMure/go-term-markdown"
 	"github.com/urfave/cli/v3"
 )
 
+const (
+	versionFmt = `esctl version: %s
+  build: %s
+  branch: %s
+  commit: %s
+  go version: %s
+  API Version: %s
+`
+
+	jsonPathUsage = `jsonPath usage:
+
+name.last          >> "Anderson"
+age                >> 37
+children           >> ["Sara","Alex","Jack"]
+children.#         >> 3
+children.1         >> "Alex"
+child*.2           >> "Jack"
+c?ildren.0         >> "Sara"
+fav\.movie         >> "Deer Hunter"
+friends.#.first    >> ["Dale","Roger","Jane"]
+friends.1.last     >> "Craig"
+
+You can also  query an array for  the first match by  using #(...), or
+find all matches  with #(...)#. Queries support the ==,  !=, <, <=, >,
+>= comparison operators  and the simple pattern matching  % (like) and
+!% (not like) operators. Eg:
+
+friends.#(last=="Murphy").first    >> "Dale"
+friends.#(last=="Murphy")#.first   >> ["Dale","Jane"]
+friends.#(age>45)#.last            >> ["Craig","Murphy"]
+friends.#(first%"D*").last         >> "Murphy"
+friends.#(first!%"D*").last        >> "Craig"
+friends.#(nets.#(=="fb"))#.first   >> ["Dale","Roger"]
+
+To extract more than one field, use:
+
+{"ns":source.namespace_name,"time":source.@timestamp} >>
+
+{
+  "ns": "3f80316965c64405-275a75782e984bcc8d82",
+  "time": "2026-06-10T04:23:38.914080361+00:00"
+}
+{
+  "ns": "3f80316965c64405-f0e1dcef668e45bb9afd",
+  "time": "2026-06-10T09:39:00.554892542+00:00"
+}
+
+
+Documentation: https://github.com/tidwall/gjson/blob/master/SYNTAX.md`
+)
+
 func Finish(err error) int {
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "Error: ", err.Error())
+
 		return 1
 	}
 
@@ -89,7 +144,7 @@ func Main() int {
 				Name:        "output",
 				Aliases:     []string{"o"},
 				Value:       "",
-				Usage:       "output mode (tsv, json, yaml) default: tsv",
+				Usage:       "output mode (tsv, csv, json, yaml) default: tsv",
 				Destination: &conf.Output,
 			},
 			&cli.StringFlag{
@@ -112,6 +167,7 @@ func Main() int {
 			Node(conf),
 			Roles(conf),
 			Search(conf),
+			SearchQL(conf),
 			Shard(conf),
 			Snapshot(conf),
 			Task(conf),
@@ -119,6 +175,7 @@ func Main() int {
 			Debug(conf),
 			HelpJsonPath(conf),
 			HelpUsage(conf),
+			HelpEsQl(conf),
 		},
 
 		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
@@ -127,6 +184,7 @@ func Main() int {
 					return nil, err
 				} else {
 					fmt.Println(cmd.UsageText)
+
 					return nil, nil
 				}
 			}
@@ -161,66 +219,43 @@ func Main() int {
 }
 
 func HelpJsonPath(conf *cfg.Config) *cli.Command {
-	msg := `jsonPath usage:
-
-name.last          >> "Anderson"
-age                >> 37
-children           >> ["Sara","Alex","Jack"]
-children.#         >> 3
-children.1         >> "Alex"
-child*.2           >> "Jack"
-c?ildren.0         >> "Sara"
-fav\.movie         >> "Deer Hunter"
-friends.#.first    >> ["Dale","Roger","Jane"]
-friends.1.last     >> "Craig"
-
-You can also  query an array for  the first match by  using #(...), or
-find all matches  with #(...)#. Queries support the ==,  !=, <, <=, >,
->= comparison operators  and the simple pattern matching  % (like) and
-!% (not like) operators. Eg:
-
-friends.#(last=="Murphy").first    >> "Dale"
-friends.#(last=="Murphy")#.first   >> ["Dale","Jane"]
-friends.#(age>45)#.last            >> ["Craig","Murphy"]
-friends.#(first%"D*").last         >> "Murphy"
-friends.#(first!%"D*").last        >> "Craig"
-friends.#(nets.#(=="fb"))#.first   >> ["Dale","Roger"]
-
-To extract more than one field, use:
-
-{"ns":source.namespace_name,"time":source.@timestamp} >>
-
-{
-  "ns": "3f80316965c64405-275a75782e984bcc8d82",
-  "time": "2026-06-10T04:23:38.914080361+00:00"
-}
-{
-  "ns": "3f80316965c64405-f0e1dcef668e45bb9afd",
-  "time": "2026-06-10T09:39:00.554892542+00:00"
-}
-
-
-Documentation: https://github.com/tidwall/gjson/blob/master/SYNTAX.md`
-
 	return &cli.Command{
 		Name:  "help-jsonpath",
 		Usage: "show jsonpath help",
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			_, err := fmt.Println(msg)
+			_, err := fmt.Println(jsonPathUsage)
+
 			return err
 		},
 	}
 }
 
+func HelpEsQl(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "help-esql",
+		Usage: "show esql help",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			assets.LoadEsql()
+
+			width := cfg.GetTermWidth()
+			printer.Pager("esql cheat sheet", string(markdown.Render(assets.EsQlCheatSheet, width, cfg.DefaultMargin)))
+
+			return nil
+		},
+	}
+}
+
 func Version(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "version",
 		Usage: "show esctl version information",
 
 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			_, err := fmt.Printf("esctl version: %s\n  build: %s\n  branch: %s\n  commit: %s\n  go version: %s\n  API Version: %s\n",
+			_, err := fmt.Printf(versionFmt,
 				cfg.Version, cfg.BUILD, cfg.BRANCH, cfg.COMMIT, cfg.GOVERSION, cfg.APIVERSION)
+
 			return err
 		},
 	}
@@ -327,7 +362,6 @@ func HelpUsage(conf *cfg.Config) *cli.Command {
 			})
 		},
 	}
-
 }
 
 // copy of cmd.Walk() with the exception to skip hidden commands and its siblings

cmd/search.go

@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"context"
+	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -45,6 +46,11 @@ https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#dat
 For timestamp formats refer to:
 https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format`
 
+const QlUsage = `ES|QL documentation:
+https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started
+
+See also: esctl help-esql`
+
 func Search(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:               "search",
@@ -149,3 +155,19 @@ func Search(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func SearchQL(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:               "searchql",
+		Aliases:            []string{"/"},
+		Usage:              "search using ES/QL language",
+		UsageText:          "search <ES/QL term>",
+		CustomHelpTemplate: addReference(QlUsage),
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			args := cmd.Args()
+
+			return es.SearchQL(conf, strings.Join(args.Slice(), " "))
+		},
+	}
+}

cmd/utilities.go

@@ -26,9 +26,10 @@ import (
 func addReference(ref string) string {
 	indentedRef := []string{}
 
-	for _, line := range strings.Split(ref, "\n") {
+	for line := range strings.SplitSeq(ref, "\n") {
 		indentedRef = append(indentedRef, "   "+line)
 	}
+
 	return fmt.Sprintf("%s\nREFERENCE:\n%s\n",
 		cli.SubcommandHelpTemplate,
 		strings.Join(indentedRef, "\n"))

go.mod

@@ -14,7 +14,7 @@
 // along with this program. If not, see <http://www.gnu.org/licenses/>.
 module codeberg.org/scip/esctl
 
-go 1.25.8
+go 1.26
 
 require (
 	github.com/MichaelMure/go-term-markdown v0.1.4

pkg/cfg/cluster.go

@@ -55,37 +55,6 @@ func (cluster *Cluster) SetClient(client *elasticsearch.TypedClient) {
 	cluster.client = client
 }
 
-func (cluster *Cluster) getTransport() elastictransport.Option {
-	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-	}
-
-	if cluster.DebugHTTP {
-		return elastictransport.WithTransport(
-			&DebugTransport{Transport: transport},
-		)
-	}
-
-	return elastictransport.WithTransport(transport)
-}
-
-func (cluster *Cluster) getDefaultOptions() []elasticsearch.Option {
-	// These headers are  not needed with ES 9, but with  ES 8, we set
-	// them here  so every API call uses it.  The only exception being
-	// the api repl, which does it on its own.
-	headers := http.Header{}
-	headers.Add("content-type", "application/json")
-	headers.Add("Accept", "application/json")
-
-	return []elasticsearch.Option{
-		elasticsearch.WithAddresses(cluster.Uri),
-		elasticsearch.WithTransportOptions(
-			cluster.getTransport(),
-			elastictransport.WithHeader(headers),
-		),
-	}
-}
-
 // return the  go-elasticsearch client  object but before  doing that,
 // check if we need to tune auth
 func (cluster *Cluster) ES() *elasticsearch.TypedClient {
@@ -114,7 +83,8 @@ func (cluster *Cluster) CheckAuth() error {
 		} else {
 			// k, try interactively
 			fmt.Fprintf(os.Stderr, "Enter password for elasticsearch user %s@%s: ", cluster.User, cluster.Name)
-			pass, err := term.ReadPassword(int(syscall.Stdin))
+
+			pass, err := term.ReadPassword(syscall.Stdin)
 			if err != nil {
 				return err
 			}
@@ -125,6 +95,7 @@ func (cluster *Cluster) CheckAuth() error {
 			}
 
 			cluster.Pass = string(pass)
+
 			fmt.Println()
 		}
 
@@ -132,7 +103,6 @@ func (cluster *Cluster) CheckAuth() error {
 		opts = append(opts, elasticsearch.WithBasicAuth(cluster.User, cluster.Pass))
 
 		es, err := elasticsearch.NewTyped(opts...)
-
 		if err != nil {
 			return fmt.Errorf("failed to setup elasticsearch connection: %w", err)
 		}
@@ -205,6 +175,40 @@ func (cluster *Cluster) IsReachable() (bool, error) {
 	return true, conn.Close()
 }
 
+func (cluster *Cluster) getDefaultOptions() []elasticsearch.Option {
+	// These headers are  not needed with ES 9, but with  ES 8, we set
+	// them here  so every API call uses it.  The only exception being
+	// the api repl, which does it on its own.
+	headers := http.Header{}
+	headers.Add("Content-Type", "application/json")
+	headers.Add("Accept", "application/json")
+
+	return []elasticsearch.Option{
+		elasticsearch.WithAddresses(cluster.Uri),
+		elasticsearch.WithTransportOptions(
+			cluster.getTransport(),
+			elastictransport.WithHeader(headers),
+		),
+		elasticsearch.WithCompatibilityMode(),
+	}
+}
+
+func (cluster *Cluster) getTransport() elastictransport.Option {
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+
+	if cluster.DebugHTTP {
+		return elastictransport.WithTransport(
+			&DebugTransport{Transport: transport},
+		)
+	}
+
+	return elastictransport.WithTransport(
+		&CompatibilityTransport{Transport: transport},
+	)
+}
+
 func (conf *Config) SetupES() error {
 	for name, cluster := range conf.Clusters {
 		cluster.Name = name
@@ -220,7 +224,6 @@ func (conf *Config) SetupES() error {
 		}
 
 		es, err := elasticsearch.NewTyped(opts...)
-
 		if err != nil {
 			return fmt.Errorf("failed to setup elasticsearch connection: %w", err)
 		}

pkg/cfg/config.go

@@ -82,8 +82,9 @@ type Config struct {
 	SortBy    string // sort: -k
 	Ascending bool   // sort: -a
 
+	All                            bool   // doc + node ls: -a
 	Exclude                        string // cluster compare: -e (regexp)
-	All, Verbose                   bool   // cluster status: -a -v
+	Verbose                        bool   // cluster status: -v
 	Persistent, Transient, Default bool   // cluster settings set: -p -t -D
 
 	Force bool // ccr follower renew: -f
@@ -101,6 +102,7 @@ type Config struct {
 	DryRun                              bool // rollover: -n
 
 	Tag      string // api ls: -t
+	HumanCat bool   // api repl: -H
 
 	Ilm Ilm // ilm create
 
@@ -151,45 +153,6 @@ func (conf *Config) Init() error {
 	return nil
 }
 
-func (conf *Config) determineDefaultCluster() error {
-	if conf.CurrentCluster != "" {
-		// -C specified, set current cluster explicitly, no matter what the config says
-		current, exists := conf.Clusters[conf.CurrentCluster]
-		if !exists {
-			return fmt.Errorf("no cluster with alias %s configured", conf.CurrentCluster)
-		} else {
-			conf.DefaultCluster = current
-
-			// disable all others
-			for _, cluster := range conf.Clusters {
-				cluster.Default = false
-			}
-
-			conf.DefaultCluster.Default = true
-		}
-	} else {
-		// we need to determine ourselfes
-		if len(conf.Clusters) == 1 {
-			// ok, just one cluster configured, use this, of course
-			for name, cluster := range conf.Clusters {
-				conf.DefaultCluster = cluster
-				conf.CurrentCluster = name
-				conf.DefaultCluster.Default = true
-			}
-		} else {
-			// multiple ones exists, look if one is set as default
-			for name, cluster := range conf.Clusters {
-				if cluster.Default {
-					conf.DefaultCluster = cluster
-					conf.CurrentCluster = name
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
 // we are  using reflect to  clone a config obj  w/o the ES  stuff for
 // shorter repr.Println() output (the ES structure is just too large)
 func (conf *Config) Clone() Config {
@@ -198,14 +161,14 @@ func (conf *Config) Clone() Config {
 	ref := reflect.ValueOf(*conf)
 	typeOfS := ref.Type()
 
-	for i := 0; i < ref.NumField(); i++ {
+	for idx := range ref.NumField() {
-		field := typeOfS.Field(i).Name
+		field := typeOfS.Field(idx).Name
 
-		if field == "Clusters" || field == "DefaultCluster" || !ref.Field(i).CanInterface() {
+		if field == "Clusters" || field == "DefaultCluster" || !ref.Field(idx).CanInterface() {
 			continue
 		}
 
-		reflect.ValueOf(&clone).Elem().FieldByName(field).Set(reflect.ValueOf(ref.Field(i).Interface()))
+		reflect.ValueOf(&clone).Elem().FieldByName(field).Set(reflect.ValueOf(ref.Field(idx).Interface()))
 	}
 
 	return clone
@@ -266,6 +229,7 @@ func (conf *Config) LoadConfig() error {
 		for _, cluster := range conf.Clusters {
 			if cluster.Default {
 				conf.DefaultCluster = cluster
+
 				break
 			}
 		}
@@ -278,9 +242,47 @@ func (conf *Config) LoadConfig() error {
 	return nil
 }
 
+func (conf *Config) determineDefaultCluster() error {
+	if conf.CurrentCluster != "" {
+		// -C specified, set current cluster explicitly, no matter what the config says
+		current, exists := conf.Clusters[conf.CurrentCluster]
+		if !exists {
+			return fmt.Errorf("no cluster with alias %s configured", conf.CurrentCluster)
+		} else {
+			conf.DefaultCluster = current
+
+			// disable all others
+			for _, cluster := range conf.Clusters {
+				cluster.Default = false
+			}
+
+			conf.DefaultCluster.Default = true
+		}
+	} else {
+		// we need to determine ourselfes
+		if len(conf.Clusters) == 1 {
+			// ok, just one cluster configured, use this, of course
+			for name, cluster := range conf.Clusters {
+				conf.DefaultCluster = cluster
+				conf.CurrentCluster = name
+				conf.DefaultCluster.Default = true
+			}
+		} else {
+			// multiple ones exists, look if one is set as default
+			for name, cluster := range conf.Clusters {
+				if cluster.Default {
+					conf.DefaultCluster = cluster
+					conf.CurrentCluster = name
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
 func fileExists(filename string) bool {
 	info, err := os.Stat(filename)
-
 	if err != nil {
 		// return false on any error
 		return false

pkg/cfg/jq.go

@@ -25,6 +25,7 @@ import (
 
 func isJQinstalled() bool {
 	cmd := exec.CommandContext(context.Background(), "jq", "-h")
+
 	out, err := cmd.Output()
 	if err != nil {
 		return false

pkg/cfg/transport.go

@@ -43,15 +43,18 @@ func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 		}
 
 		var pretty bytes.Buffer
+
 		err = json.Indent(&pretty, buf.Bytes(), "", "\t")
 		if err != nil {
-			return nil, fmt.Errorf("json parse error: %s", err)
+			return nil, fmt.Errorf("json parse error: %w", err)
 		}
 
 		content = pretty.String()
 		contentline = buf.String()
 	}
 
+	req = fixRequestHeaders(req)
+
 	slog.Info("req", "host", req.URL.Host, "uri", req.URL.Path,
 		"body", content, "bodyline", contentline,
 		"headers", req.Header,
@@ -59,3 +62,32 @@ func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	return t.Transport.RoundTrip(req)
 }
+
+type CompatibilityTransport struct {
+	Transport http.RoundTripper
+}
+
+func (t *CompatibilityTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = fixRequestHeaders(req)
+
+	return t.Transport.RoundTrip(req)
+}
+
+// Fixes https://codeberg.org/scip/esctl/issues/79:
+// the API client has this Accept header hardcoded everywhere:
+// req.Header.Set("Accept", "application/vnd.elasticsearch+json;compatible-with=9")
+// While this works pretty well with ES9, it doesn't with ES8. So, we replace
+// this header with a new one without the compatibility part.
+func fixRequestHeaders(req *http.Request) *http.Request {
+	if req.Header.Get("Accept") != "" {
+		req.Header.Del("Accept")
+		req.Header.Add("Accept", "application/json")
+	}
+
+	if req.Header.Get("Content-Type") != "" {
+		req.Header.Del("Content-Type")
+		req.Header.Add("Content-Type", "application/json")
+	}
+
+	return req
+}

pkg/es/api.go

@@ -26,6 +26,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"log/slog"
 	"net/http"
 	"os"
@@ -44,22 +45,25 @@ import (
 )
 
 const (
-	intro = `Input format: verb path [data]"
+	intro = `# Input format: verb path [data]"
-
+# 
-Example:
+# Example:
-
+# 
-post /yourindex/_ccr/pause_follow
+# post /yourindex/_ccr/pause_follow
-put /yourindex/_settings {"number_of_replicas": 1}
+# put /yourindex/_settings {"number_of_replicas": 1}
-
+# 
-You can also put multiline JSON after the path like:
+# You can also put multiline JSON after the path like:
-
+# 
-put /yourindex/_settings
+# put /yourindex/_settings
-{
+# {
-  "number_of_replicas": 1
+#   "number_of_replicas": 1
-}
+# }
-
+# 
-If you do NOT  supply a JSON in the first line, you  need to hit ENTER
+# If you do NOT  supply a JSON in the first line, you  need to hit ENTER
-twice to complete.`
+# twice to complete.
+#
+# Supply the flag --human-readable-cat, -H to view /_cat API calls in
+# human readable form.`
 )
 
 // holds an API operation via go-openapi/spec
@@ -92,9 +96,8 @@ func ApiRepl(conf *cfg.Config) error {
 		EOFPrompt:         "exit",
 		HistorySearchFold: true,
 	})
-
 	if err != nil {
-		return fmt.Errorf("failed to initialize readline lib: %s", err)
+		return fmt.Errorf("failed to initialize readline lib: %w", err)
 	}
 
 	for {
@@ -112,11 +115,13 @@ func ApiRepl(conf *cfg.Config) error {
 		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
 		if len(parts) < 2 {
 			fmt.Println("error: you need to input a verb, uri [and post data]")
+
 			continue
 		}
 
 		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
 			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
+
 			continue
 		}
 
@@ -141,9 +146,14 @@ func ApiRepl(conf *cfg.Config) error {
 			fmt.Printf("failed to call API: %s\n", esErrorString(err))
 		}
 
+		if conf.HumanCat && strings.HasPrefix(parts[1], "/_cat") {
+			fmt.Println(string(raw))
+		} else {
 			pageJsonOutput(conf, raw)
 		}
+	}
 
+	//nolint:nilerr
 	return nil
 }
 
@@ -175,7 +185,6 @@ func pageJsonOutput(conf *cfg.Config, raw []byte) {
 			pager.Stderr = os.Stderr
 
 			err := pager.Run()
-
 			if err != nil {
 				fmt.Printf("failed to execute pager '%s': %s", conf.Pager, err)
 			}
@@ -197,16 +206,16 @@ func CallAPI(conf *cfg.Config, verb, path, data string) ([]byte, error) {
 	verb = strings.ToUpper(verb)
 
 	// we're using port-forwards anyway
-	tr := &http.Transport{
+	noVerifyTransport := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
 
-	client := &http.Client{Transport: tr}
+	client := &http.Client{Transport: noVerifyTransport}
 
 	if conf.DebugHTTP {
 		client = &http.Client{
 			Transport: &cfg.DebugTransport{
-				Transport: tr}}
+				Transport: noVerifyTransport}}
 	}
 
 	req, err := http.NewRequest(verb, conf.DefaultCluster.Uri+path, bytes.NewBuffer([]byte(data)))
@@ -214,8 +223,10 @@ func CallAPI(conf *cfg.Config, verb, path, data string) ([]byte, error) {
 		return nil, err
 	}
 
+	if !conf.HumanCat || (conf.HumanCat && !strings.HasPrefix(path, "/_cat")) {
 		req.Header.Add("Content-Type", "application/json")
-	req.Header.Add("accept", "application/json")
+		req.Header.Add("Accept", "application/json")
+	}
 
 	// make sure we have got all we need
 	if err := conf.DefaultCluster.CheckAuth(); err != nil {
@@ -233,11 +244,16 @@ func CallAPI(conf *cfg.Config, verb, path, data string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Fatal(err)
+		}
+	}()
 
 	// Read and print response
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response body: %s", err)
+		return nil, fmt.Errorf("failed to read response body: %w", err)
 	}
 
 	return body, nil
@@ -249,6 +265,7 @@ func prettyfiJson(conf *cfg.Config, raw []byte) (string, error) {
 		cmd.Stdin = bytes.NewReader(raw)
 
 		var out bytes.Buffer
+
 		cmd.Stdout = &out
 
 		err := cmd.Run()
@@ -258,10 +275,13 @@ func prettyfiJson(conf *cfg.Config, raw []byte) (string, error) {
 
 		return out.String(), nil
 	}
+
 	var pretty bytes.Buffer
+
 	err := json.Indent(&pretty, raw, "", "\t")
 	if err != nil {
-		return "", fmt.Errorf("json parse error: %s", err)
+		//nolint:nilerr
+		return string(raw), nil
 	}
 
 	return pretty.String(), nil
@@ -270,10 +290,10 @@ func prettyfiJson(conf *cfg.Config, raw []byte) (string, error) {
 // interactively  read  arbitrary  JSON  data  from  STDIN,  which  is
 // virtually a repl inside the primary repl
 func readJSON(input string) (string, error) {
-	data := ""
+	data := strings.Builder{}
 
 	if input != "" {
-		data = input
+		data.WriteString(input)
 	} else {
 		scanner := bufio.NewScanner(os.Stdin)
 		for scanner.Scan() {
@@ -283,23 +303,23 @@ func readJSON(input string) (string, error) {
 				break
 			}
 
-			data += line
+			data.WriteString(line)
 		}
 	}
 
-	if data == "" {
+	if data.Len() == 0 {
-		return data, nil
+		return "", nil
 	}
 
 	// validate
 	check := map[string]any{}
-	err := json.Unmarshal([]byte(data), &check)
-	if err != nil {
-		return "", fmt.Errorf("error: input data is not proper JSON: %s", err)
 
+	err := json.Unmarshal([]byte(data.String()), &check)
+	if err != nil {
+		return "", fmt.Errorf("error: input data is not proper JSON: %w", err)
 	}
 
-	return data, nil
+	return data.String(), nil
 }
 
 func ApiList(conf *cfg.Config, pattern string) error {
@@ -338,6 +358,7 @@ func ApiList(conf *cfg.Config, pattern string) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -345,10 +366,13 @@ func ApiList(conf *cfg.Config, pattern string) error {
 func ApiPathNames() []string {
 	assets.LoadAssetOpenApi()
 
-	paths := []string{}
+	paths := make([]string, len(assets.OpenAPI.Spec().Paths.Paths))
+
+	idx := 0
 
 	for path := range assets.OpenAPI.Spec().Paths.Paths {
-		paths = append(paths, path)
+		paths[idx] = path
+		idx++
 	}
 
 	return paths
@@ -356,6 +380,7 @@ func ApiPathNames() []string {
 
 func ApiShow(conf *cfg.Config, showpath, verb string) error {
 	assets.LoadAssetOpenApi()
+
 	out := printer.Builder{}
 
 	op, err := matchOperation(showpath, verb)
@@ -372,18 +397,20 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {
 	sample := getApiExample(op)
 	description := markdown.Render(cleanMarkup.ReplaceAllString(op.Op.Description, ""), width, cfg.DefaultMargin)
 
-	var bold = lipgloss.NewStyle().
+	var (
+		bold = lipgloss.NewStyle().
 			Bold(true)
-	var paragraph = lipgloss.NewStyle().
+		paragraph = lipgloss.NewStyle().
 				MarginBottom(1).
 				MarginLeft(cfg.DefaultMargin)
-	var boldparagraph = lipgloss.NewStyle().
+		boldparagraph = lipgloss.NewStyle().
 				MarginBottom(1).
 				MarginLeft(cfg.DefaultMargin).
 				Bold(true)
-	var indentparagraph = lipgloss.NewStyle().
+		indentparagraph = lipgloss.NewStyle().
 				MarginBottom(1).
 				MarginLeft(2)
+	)
 
 	out.WriteStringLine(bold.Render("ID: " + op.Op.ID))
 	out.WriteStringLine(paragraph.Render(fmt.Sprintf("%s %s", op.Verb, showpath)))
@@ -399,10 +426,11 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {
 
 	if len(params.Path) > 0 {
 		out.WriteStringLine(bold.Render("Path Parameters"))
+
 		for _, param := range params.Path {
 			out.WriteStringLine(boldparagraph.Render(param.Param))
+
 			if param.Description != "" {
-				//out.WriteStringLine(indentparagraph.Render(param.Description))
 				out.WriteStringLine(param.Description)
 			}
 		}
@@ -410,8 +438,10 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {
 
 	if len(params.Query) > 0 {
 		out.WriteStringLine(bold.Render("Query Parameters"))
+
 		for _, param := range params.Query {
 			out.WriteStringLine(boldparagraph.Render(param.Param))
+
 			if param.Description != "" {
 				out.WriteStringLine(indentparagraph.Render(param.Description))
 			}
@@ -493,10 +523,8 @@ func getApiExample(op *Op) string {
 					if hassource {
 						sample = strings.TrimSpace(source.(string))
 					}
-
 				}
 			}
-
 		}
 	}
 
@@ -509,11 +537,13 @@ func getApiExample(op *Op) string {
 func matchOperation(showpath, verb string) (*Op, error) {
 	ops := []*Op{}
 	op := &Op{}
+
 	var found bool
 
 	for path, item := range assets.OpenAPI.Spec().Paths.Paths {
 		if path == showpath {
 			ops = findOperation(item.PathItemProps)
+
 			break
 		}
 	}
@@ -530,6 +560,7 @@ func matchOperation(showpath, verb string) (*Op, error) {
 		if strings.ToLower(item.Verb) == verb {
 			op = item
 			found = true
+
 			break
 		}
 	}

pkg/es/ccr.go

@@ -46,9 +46,8 @@ func CcrStatus(conf *cfg.Config, leader, follower string) error {
 		}
 
 		// reverse attribution
-		f := follower
+		follower, leader = leader, follower
-		follower = leader
+
-		leader = f
 		slog.Debug("leader/follower attribution is invalid, reversing", "leader", leader, "follower", follower)
 	}
 
@@ -58,7 +57,7 @@ func CcrStatus(conf *cfg.Config, leader, follower string) error {
 		res, err := conf.Clusters[alias].ES().Cat.Indices().
 			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to get indicies on %s: %s", alias, esErrorString(err))
+			return fmt.Errorf("failed to get indicies on %s: %w", alias, esErrorString(err))
 		}
 
 		indices[alias] = make(map[string]*types.IndicesRecord, len(res))
@@ -87,17 +86,19 @@ func CcrRemoteInfo(conf *cfg.Config, index string) error {
 	res, err := conf.DefaultCluster.ES().Cluster.RemoteInfo().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve follower info: %w", esErrorString(err))
 	}
 
 	slog.Debug("ccr remote info", "info", res)
 
 	remote := ""
+
 	var info *types.ClusterRemoteProxyInfo
 
 	for name, data := range res {
 		remote = name
 		info = data.(*types.ClusterRemoteProxyInfo)
+
 		break
 	}
 

pkg/es/ccr_follower.go

@@ -18,6 +18,7 @@ package es
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 
@@ -29,17 +30,18 @@ func getRemoteName(conf *cfg.Config) (string, error) {
 	res, err := conf.DefaultCluster.ES().Cluster.RemoteInfo().
 		Do(context.Background())
 	if err != nil {
-		return "", fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
+		return "", fmt.Errorf("failed to retrieve follower info: %w", esErrorString(err))
 	}
 
 	remote := ""
 	for name := range res {
 		remote = name
+
 		break
 	}
 
 	if remote == "" {
-		return "", fmt.Errorf("cluster doesn't have a follower")
+		return "", errors.New("cluster doesn't have a follower")
 	}
 
 	return remote, nil
@@ -61,26 +63,31 @@ func CcrFollowerRenew(conf *cfg.Config, index string) error {
 	if err := wrapError(IndexClose, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("closed %s", index)
 
 	if err := wrapError(CcrFollowerPause, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("paused %s", index)
 
 	if err := wrapError(CcrFollowerUnfollow, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("unfollowed %s", index)
 
 	if err := wrapError(IndexDelete, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("deleted %s", index)
 
 	if err := CcrFollowerAdd(conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("added follower %s", index)
 
 	return nil
@@ -89,9 +96,8 @@ func CcrFollowerRenew(conf *cfg.Config, index string) error {
 func CcrFollowerResume(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Ccr.ResumeFollow(index).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to resume ccr following: %s", esErrorString(err))
+		return fmt.Errorf("failed to resume ccr following: %w", esErrorString(err))
 	}
 
 	return nil
@@ -100,9 +106,8 @@ func CcrFollowerResume(conf *cfg.Config, index string) error {
 func CcrFollowerPause(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Ccr.PauseFollow(index).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to pause ccr following: %s", esErrorString(err))
+		return fmt.Errorf("failed to pause ccr following: %w", esErrorString(err))
 	}
 
 	return nil
@@ -111,9 +116,8 @@ func CcrFollowerPause(conf *cfg.Config, index string) error {
 func CcrFollowerUnfollow(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Ccr.ForgetFollower(index).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to unfollow index: %s", esErrorString(err))
+		return fmt.Errorf("failed to unfollow index: %w", esErrorString(err))
 	}
 
 	return nil
@@ -134,9 +138,8 @@ func CcrFollowerAdd(conf *cfg.Config, index string) error {
 	}
 
 	_, err = create.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create follower index: %s", esErrorString(err))
+		return fmt.Errorf("failed to create follower index: %w", esErrorString(err))
 	}
 
 	return nil
@@ -146,7 +149,7 @@ func CcrFollowerShow(conf *cfg.Config, index string) error {
 	res, err := conf.DefaultCluster.ES().Ccr.FollowStats(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower index info: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve follower index info: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "follower stats", res.Indices)

pkg/es/cluster.go

@@ -38,22 +38,22 @@ type clusterReachable struct {
 }
 
 func ClusterList(conf *cfg.Config) error {
-	var mu sync.Mutex
+	var (
-	var wg sync.WaitGroup
+		mu sync.Mutex
+		wg sync.WaitGroup
+	)
+
 	reachable := make(map[string]clusterReachable, len(conf.Clusters))
 
 	// check endpoints in parallel to speed things up
 	for name, cluster := range conf.Clusters {
-		wg.Add(1)
+		wg.Go(func() {
-
-		go func() {
-			defer wg.Done()
 			online, err := cluster.IsReachable()
 
 			mu.Lock()
 			reachable[name] = clusterReachable{reachable: online, err: err}
 			mu.Unlock()
-		}()
+		})
 	}
 
 	wg.Wait()
@@ -121,26 +121,26 @@ func getClusterStatus(conf *cfg.Config) (*apiResponse, error) {
 
 	var err error
 
-	for i := 0; i < gocount; i++ {
+	for range gocount {
-		r := <-responses
+		res := <-responses
 
-		err = errors.Join(err, r.error)
+		err = errors.Join(err, res.error)
 
-		switch r.which {
+		switch res.which {
 		case ResponseHealth:
-			all.health = r.health
+			all.health = res.health
 		case ResponseCcr:
-			all.ccr = r.ccr
+			all.ccr = res.ccr
 		case ResponseInfo:
-			all.info = r.info
+			all.info = res.info
 		case ResponseStats:
-			all.stats = r.stats
+			all.stats = res.stats
 		case ResponseIndices:
-			all.indices = r.indices
+			all.indices = res.indices
 		case ResponseTasks:
-			all.tasks = r.tasks
+			all.tasks = res.tasks
 		case ResponseHealthReport:
-			all.healthreport = r.healthreport
+			all.healthreport = res.healthreport
 		}
 	}
 
@@ -155,8 +155,10 @@ func ClusterStatus(conf *cfg.Config) error {
 
 	slog.Debug("ES result", "cluster health", res.health)
 
-	var isleader bool
+	var (
-	var ccrfollowing string
+		isleader     bool
+		ccrfollowing string
+	)
 
 	if res.ccr != nil {
 		isleader = len(res.ccr.AutoFollowStats.AutoFollowedClusters) == 0
@@ -172,15 +174,22 @@ func ClusterStatus(conf *cfg.Config) error {
 	}
 
 	// look for red indices, if any
-	redindices := 0
+	failedIndices := 0
+	greenIndices := 0
+
 	for _, index := range *res.indices {
-		if *index.Health == "red" {
+		switch {
-			redindices++
+		case *index.Health != "green":
+			failedIndices++
+		case !strings.HasPrefix(*index.Index, "."):
+			// don't count internal indices
+			greenIndices++
 		}
 	}
 
 	// look for long running tasks
 	longtasks := 0
+
 	for _, task := range *res.tasks {
 		if strings.Contains(*task.RunningTime, "d") {
 			longtasks++
@@ -201,7 +210,8 @@ func ClusterStatus(conf *cfg.Config) error {
 		{"Unassigned Primary Shards", res.health.UnassignedPrimaryShards},
 		{"Pending Tasks", res.health.NumberOfPendingTasks},
 		{"Nodes", res.health.NumberOfNodes},
-		{"Red Indices", redindices},
+		{"Green Indices", greenIndices},
+		{"Failed Indices", failedIndices},
 		{"Long Running Tasks", longtasks},
 	}
 
@@ -213,7 +223,7 @@ func ClusterStatus(conf *cfg.Config) error {
 	}
 
 	if conf.Verbose {
-		table = gatherClusterStats(conf, res.stats, table)
+		table = gatherClusterStats(res.stats, table)
 	}
 
 	if res.health.Status.Name != "green" {
@@ -229,6 +239,10 @@ func ClusterStatus(conf *cfg.Config) error {
 					for resource, items := range diag.AffectedResources {
 						table.Entries = append(table.Entries, []any{"    -> affected " + resource, strings.Join(items, ",")})
 					}
+
+					if diag.Action != "" {
+						table.AddRow("        -> suggested action to fix", diag.Action)
+					}
 				}
 			}
 		}
@@ -241,9 +255,11 @@ func ClusterStatus(conf *cfg.Config) error {
 	return nil
 }
 
-func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, table *printer.Table) *printer.Table {
+func gatherClusterStats(clusterstats *clusterstats.Response, table *printer.Table) *printer.Table {
-	var querycount int64
+	var (
-	var vmversion string
+		querycount int64
+		vmversion  string
+	)
 
 	for _, count := range clusterstats.Indices.Search.Queries {
 		querycount += count

pkg/es/cluster_reroute.go

@@ -118,6 +118,7 @@ func ClusterRerouteAllocatePrimary(conf *cfg.Config, index string, stale bool) e
 		if stale {
 			which = "stale"
 		}
+
 		return fmt.Errorf("failed to allocate %s primary shard: %w", which, err)
 	}
 

pkg/es/cluster_settings.go

@@ -35,11 +35,12 @@ func ClusterSettingsList(conf *cfg.Config) error {
 		FlatSettings(true).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get cluster settings: %s", esErrorString(err))
+		return fmt.Errorf("failed to get cluster settings: %w", esErrorString(err))
 	}
 
 	table := printer.NewTable(conf, 2, 0)
 	table.Addheaders("setting", "value")
+
 	entries := [][]any{}
 
 	settingshash := res.Persistent // == map[string]json.RawMessage
@@ -75,23 +76,25 @@ func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
 		case conf.Transient:
 			message, err := json.Marshal(value)
 			if err != nil {
-				return fmt.Errorf("failed to marshall transient value <%v> to valid JSON: %s", value, err)
+				return fmt.Errorf("failed to marshall transient value <%v> to valid JSON: %w", value, err)
 			}
+
 			put.AddTransient(setting, message)
 		case conf.Persistent:
 			fallthrough
 		default:
 			message, err := json.Marshal(value)
 			if err != nil {
-				return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %s", value, err)
+				return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %w", value, err)
 			}
+
 			put.AddPersistent(setting, message)
 		}
 	}
 
 	_, err := put.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to set settings: %s", esErrorString(err))
+		return fmt.Errorf("failed to set settings: %w", esErrorString(err))
 	}
 
 	return nil
@@ -100,15 +103,14 @@ func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
 func ClusterSettingsSetSingle(conf *cfg.Config, setting, value string) error {
 	message, err := json.Marshal(value)
 	if err != nil {
-		return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %s", value, err)
+		return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %w", value, err)
 	}
 
 	_, err = conf.DefaultCluster.ES().Cluster.PutSettings().
 		AddPersistent(setting, message).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to set %s: %s", setting, esErrorString(err))
+		return fmt.Errorf("failed to set %s: %w", setting, esErrorString(err))
 	}
 
 	return nil

pkg/es/cluster_util.go

@@ -37,6 +37,7 @@ func checkClusterIsLeader(conf *cfg.Config, leader string) bool {
 		Do(context.Background())
 	if err != nil {
 		fmt.Printf("failed to get ccr stats from %s: %s", leader, esErrorString(err))
+
 		return false
 	}
 
@@ -47,6 +48,7 @@ func checkClusterIsLeader(conf *cfg.Config, leader string) bool {
 
 	if stats.AutoFollowStats.AutoFollowedClusters[0].ClusterName != "" {
 		fmt.Println("leader/follower attribution is invalid, reverse cluster attribution and retry")
+
 		return false
 	}
 
@@ -58,14 +60,15 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 	status := map[string]*health.Response{}
 
 	for _, cluster := range []string{leader, follower} {
-		st, err := conf.Clusters[leader].ES().Cluster.Health().
+		clusterHealth, err := conf.Clusters[leader].ES().Cluster.Health().
 			Do(context.Background())
 		if err != nil {
 			fmt.Printf("failed to get health from %s: %s", cluster, esErrorString(err))
+
 			return false
 		}
 
-		status[cluster] = st
+		status[cluster] = clusterHealth
 	}
 
 	table := printer.NewTable(conf, 3, 6)
@@ -98,6 +101,7 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}
 
@@ -120,6 +124,7 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
 			Do(context.Background())
 		if err != nil {
 			fmt.Printf("failed to get ilm status from %s: %s", cluster, esErrorString(err))
+
 			return false
 		}
 
@@ -158,6 +163,7 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
 
 			if err := table.Print(); err != nil {
 				fmt.Println(err)
+
 				return false
 			}
 		}
@@ -174,6 +180,7 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 	}
 
 	indexOnlyOnLeader := map[string]*types.IndicesRecord{}
+
 	for name, index := range indices[leader] {
 		if exclude.MatchString(name) {
 			continue
@@ -195,9 +202,11 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 			}
 
 			isWritable := false
+
 			for _, alias := range res[name].Aliases {
 				if *alias.IsWriteIndex {
 					isWritable = true
+
 					break
 				}
 			}
@@ -227,8 +236,10 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}
 
@@ -275,8 +286,10 @@ func findOrphanedIndices(conf *cfg.Config, indices ClusterIndices, leader, follo
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}
 
@@ -309,8 +322,10 @@ func findFailedFollowerIndices(conf *cfg.Config, indices ClusterIndices, followe
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}
 

pkg/es/datastream.go

@@ -32,7 +32,7 @@ func DatastreamNames(conf *cfg.Config) ([]string, error) {
 	res, err := conf.DefaultCluster.ES().Indices.GetDataStream().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get data streams: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get data streams: %w", esErrorString(err))
 	}
 
 	dss := make([]string, len(res.DataStreams))
@@ -47,7 +47,7 @@ func DatastreamList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Indices.GetDataStream().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data streams: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data streams: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "data streams", res)
@@ -65,21 +65,22 @@ func DatastreamList(conf *cfg.Config) error {
 	table := printer.NewTable(conf, 7, size)
 	table.Addheaders("name", "ilm policy", "hidden", "system", "replicated", "generation", "timestamp field")
 
-	for idx, ds := range list {
+	for idx, datastream := range list {
-		name := printer.Colorize(conf, ds.Status.String(), ds.Name)
+		name := printer.Colorize(conf, datastream.Status.String(), datastream.Name)
+
 		policy := ""
-		if ds.IlmPolicy != nil {
+		if datastream.IlmPolicy != nil {
-			policy = *ds.IlmPolicy
+			policy = *datastream.IlmPolicy
 		}
 
 		table.Entries[idx] = []any{
 			name,
 			policy,
-			ds.Hidden,
+			datastream.Hidden,
-			*ds.System,
+			*datastream.System,
-			*ds.Replicated,
+			*datastream.Replicated,
-			ds.Generation,
+			datastream.Generation,
-			ds.TimestampField.Name,
+			datastream.TimestampField.Name,
 		}
 
 		if idx == size-1 {
@@ -88,6 +89,7 @@ func DatastreamList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -128,7 +130,7 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 		Name(dsname).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data stream: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data stream: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "data stream", res)
@@ -141,28 +143,29 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 		Name(dsname).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data stream stats: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data stream stats: %w", esErrorString(err))
 	}
 
 	table := printer.NewTable(conf, 11, 2)
 	table.Addheaders("data stream property", "value")
 
-	ds := res.DataStreams[0]
+	datastream := res.DataStreams[0]
+
+	name := printer.Colorize(conf, datastream.Status.String(), datastream.Name)
 
-	name := printer.Colorize(conf, ds.Status.String(), ds.Name)
 	policy := ""
-	if ds.IlmPolicy != nil {
+	if datastream.IlmPolicy != nil {
-		policy = *ds.IlmPolicy
+		policy = *datastream.IlmPolicy
 	}
 
 	table.Entries = [][]any{
 		{"name", name},
 		{"ilm policy", policy},
-		{"hidden", ds.Hidden},
+		{"hidden", datastream.Hidden},
-		{"system", *ds.System},
+		{"system", *datastream.System},
-		{"replicated", *ds.Replicated},
+		{"replicated", *datastream.Replicated},
-		{"generation", ds.Generation},
+		{"generation", datastream.Generation},
-		{"timestamp field", ds.TimestampField.Name},
+		{"timestamp field", datastream.TimestampField.Name},
 		{"backing indices", stats.BackingIndices},
 		{"size", printer.Bytes(stats.TotalStoreSizeBytes)},
 		{"shards-failed", stats.Shards_.Failed},
@@ -173,13 +176,13 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 		return err
 	}
 
-	table = printer.NewTable(conf, 5, len(ds.Indices))
+	table = printer.NewTable(conf, 5, len(datastream.Indices))
 	table.Addheaders("backing index name", "uuid", "prefer ilm", "ilm policy", "managed by")
 
-	for idx, index := range ds.Indices {
+	for idx, index := range datastream.Indices {
 		policy := ""
-		if ds.IlmPolicy != nil {
+		if datastream.IlmPolicy != nil {
-			policy = *ds.IlmPolicy
+			policy = *datastream.IlmPolicy
 		}
 
 		table.Entries[idx] = []any{
@@ -190,12 +193,13 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 			index.ManagedBy.Name,
 		}
 
-		if idx < len(ds.Indices) {
+		if idx < len(datastream.Indices) {
 			fmt.Println()
 		}
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -206,9 +210,8 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 func DatastreamCreate(conf *cfg.Config, dsname string) error {
 	_, err := conf.DefaultCluster.ES().Indices.CreateDataStream(dsname).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create datastream: %s", esErrorString(err))
+		return fmt.Errorf("failed to create datastream: %w", esErrorString(err))
 	}
 
 	return nil
@@ -217,9 +220,8 @@ func DatastreamCreate(conf *cfg.Config, dsname string) error {
 func DatastreamDelete(conf *cfg.Config, dsname string) error {
 	_, err := conf.DefaultCluster.ES().Indices.DeleteDataStream(dsname).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to delete datastream: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete datastream: %w", esErrorString(err))
 	}
 
 	return nil
@@ -227,9 +229,8 @@ func DatastreamDelete(conf *cfg.Config, dsname string) error {
 
 func DatastreamRollover(conf *cfg.Config, ds string) error {
 	res, err := RolloverAlias(conf, ds)
-
 	if err != nil {
-		return fmt.Errorf("failed to rollover data stream: %s", esErrorString(err))
+		return fmt.Errorf("failed to rollover data stream: %w", esErrorString(err))
 	}
 
 	table := printer.NewTable(conf, 2, 5)

pkg/es/doc.go

@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 	"math/rand/v2"
+	"strconv"
 	"strings"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
@@ -42,16 +43,16 @@ func DocAdd(conf *cfg.Config, jsondoc string) error {
 
 	err := json.Unmarshal([]byte(jsondoc), &data)
 	if err != nil {
-		return fmt.Errorf("supplied document was not valid JSON: %s", err)
+		return fmt.Errorf("supplied document was not valid JSON: %w", err)
 	}
 
-	now := fmt.Sprintf("%d", rand.Int64())
+	now := strconv.FormatInt(rand.Int64(), 10)
 
 	res, err := conf.DefaultCluster.ES().Create(conf.Index, now).
 		Document(data).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to create new doc in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to create new doc in index %s: %w", conf.Index, esErrorString(err))
 	}
 
 	fmt.Println(res.Id_)
@@ -63,7 +64,7 @@ func DocShow(conf *cfg.Config, id string) error {
 	res, err := conf.DefaultCluster.ES().Get(conf.Index, id).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve doc in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to retrieve doc in index %s: %w", conf.Index, esErrorString(err))
 	}
 
 	if !res.Found {
@@ -94,7 +95,7 @@ func DocDelete(conf *cfg.Config, queries []string) error {
 		_, err := conf.DefaultCluster.ES().Delete(conf.Index, id).
 			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to delete doc in index %s: %s", conf.Index, esErrorString(err))
+			return fmt.Errorf("failed to delete doc in index %s: %w", conf.Index, esErrorString(err))
 		}
 
 		return nil
@@ -117,7 +118,7 @@ func DocDelete(conf *cfg.Config, queries []string) error {
 		Request(req).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete docs in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to delete docs in index %s: %w", conf.Index, esErrorString(err))
 	}
 
 	return nil

pkg/es/duration.go

@@ -45,7 +45,6 @@ Convert a  duration into  an integer.  Valid  time units  are "s", "m", "h" and
 	via https://codeberg.org/scip/tablizer/src/branch/main/lib/sort.go#L113
 */
 func parseDuration(duration string) time.Duration {
-
 	seconds := 0
 
 	for _, match := range matchDuration.FindAllStringSubmatch(duration, -1) {
@@ -111,12 +110,14 @@ func formatDuration(val time.Duration) string {
 		if esd.minutes == 0 {
 			return fmt.Sprintf("%dh", esd.hours)
 		}
+
 		return fmt.Sprintf("%dh:%dm", esd.hours, int64(esd.minutes))
 
 	default:
 		if esd.minutes == 0 && hoursLeft == 0 {
 			return fmt.Sprintf("%dd", int64(days))
 		}
+
 		return fmt.Sprintf("%dd:%dh:%dm",
 			int64(days),
 			int64(hoursLeft),

pkg/es/errors.go

@@ -17,29 +17,31 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package es
 
 import (
+	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )
 
-func esErrorString(err error) string {
+func esErrorString(err error) error {
 	msg := err.Error()
 
-	switch e := err.(type) {
+	//nolint:gocritic
+	switch errVal := err.(type) {
 	case *types.ElasticsearchError:
-		causes := ""
+		var causes strings.Builder
 
-		for _, cause := range e.ErrorCause.RootCause {
+		for _, cause := range errVal.ErrorCause.RootCause {
-			causes += fmt.Sprintf("%s\n", *cause.Reason)
+			fmt.Fprintf(&causes, "%s\n", *cause.Reason)
 		}
 
-		if e.ErrorCause.Reason != nil {
+		if errVal.ErrorCause.Reason != nil {
-			msg = *e.ErrorCause.Reason + ": " + causes
+			msg = *errVal.ErrorCause.Reason + ": " + causes.String()
 		} else {
-			msg = fmt.Sprintf("http status %d: ", e.Status)
+			msg = fmt.Sprintf("http status %d: ", errVal.Status)
+		}
 	}
 
-	}
+	return errors.New(msg)
-
-	return msg
 }

pkg/es/ilm.go

@@ -37,7 +37,7 @@ func IlmRetry(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Ilm.Retry(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retry ilm: %s", esErrorString(err))
+		return fmt.Errorf("failed to retry ilm: %w", esErrorString(err))
 	}
 
 	return nil
@@ -47,7 +47,7 @@ func IlmStatus(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Ilm.GetStatus().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm status: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm status: %w", esErrorString(err))
 	}
 
 	fmt.Println(res.OperationMode.Name)
@@ -59,7 +59,7 @@ func IlmNames(conf *cfg.Config) ([]string, error) {
 	res, err := conf.DefaultCluster.ES().Ilm.GetLifecycle().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get ilm policies: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get ilm policies: %w", esErrorString(err))
 	}
 
 	names := make([]string, len(res))
@@ -82,7 +82,7 @@ func IlmList(conf *cfg.Config, pattern string) error {
 
 	res, err := ilm.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm policies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm policies: %w", esErrorString(err))
 	}
 
 	if conf.Debug {
@@ -102,6 +102,7 @@ func IlmList(conf *cfg.Config, pattern string) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -110,7 +111,7 @@ func IlmShow(conf *cfg.Config, policy string) error {
 		Policy(policy).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm status: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm status: %w", esErrorString(err))
 	}
 
 	if conf.Debug {
@@ -166,6 +167,7 @@ func IlmShowTree(conf *cfg.Config, ilm types.IlmPolicy) error {
 			}
 
 			indent += "    "
+
 			continue
 		}
 
@@ -260,7 +262,7 @@ func ilmPhaseString(phase *types.Phase, short bool) string {
 	}
 
 	if phase.Actions.SearchableSnapshot != nil {
-		out = append(out, fmt.Sprintf("searchable-snapshot:%s", phase.Actions.SearchableSnapshot.SnapshotRepository))
+		out = append(out, "searchable-snapshot:"+phase.Actions.SearchableSnapshot.SnapshotRepository)
 	}
 
 	return strings.Join(out, ",")
@@ -270,7 +272,7 @@ func IlmExplain(conf *cfg.Config, index string) error {
 	res, err := conf.DefaultCluster.ES().Ilm.ExplainLifecycle(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm state: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm state: %w", esErrorString(err))
 	}
 
 	slog.Debug("ilm status", "ilm", res)
@@ -286,6 +288,7 @@ func IlmExplain(conf *cfg.Config, index string) error {
 	table.Addheaders("ilm status field", "value")
 
 	info := ""
+
 	err = json.Unmarshal(ilm.StepInfo["reason"], &info)
 	if err != nil {
 		return fmt.Errorf("failed to unmarshal step info: %w", err)
@@ -345,7 +348,9 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 	if cfg.HaveHot() {
 		hot := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
+
 		rollover := &types.RolloverAction{}
 		haveroll := false
 
@@ -383,15 +388,14 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 		hot.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Hot = &hot
-	} else {
+	} else if policy != nil {
-		if policy != nil {
 		// update
 		phases.PhasesCaster().Hot = policy.Phases.Hot
 	}
-	}
 
 	if cfg.HaveWarm() {
 		warm := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
 		if policy != nil {
@@ -417,15 +421,14 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 		warm.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Warm = &warm
-	} else {
+	} else if policy != nil && policy.Phases.Warm != nil {
-		if policy != nil && policy.Phases.Warm != nil {
 		// update
 		phases.PhasesCaster().Warm = policy.Phases.Warm
 	}
-	}
 
 	if cfg.HaveCold() {
 		cold := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
 		if policy != nil {
@@ -452,15 +455,14 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 		cold.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Cold = &cold
-	} else {
+	} else if policy != nil && policy.Phases.Cold != nil {
-		if policy != nil && policy.Phases.Cold != nil {
 		// update
 		phases.PhasesCaster().Cold = policy.Phases.Cold
 	}
-	}
 
 	if cfg.HaveFrozen() {
 		froze := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
 		if policy != nil {
@@ -479,16 +481,15 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 		froze.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Frozen = &froze
-	} else {
+	} else if policy != nil && policy.Phases.Frozen != nil {
-		if policy != nil && policy.Phases.Frozen != nil {
 		// update
 		phases.PhasesCaster().Frozen = policy.Phases.Frozen
 	}
-	}
 
 	if cfg.HaveDelete() {
 		del := types.Phase{}
 		delete := types.DeleteAction{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
 
 		if policy != nil {
@@ -507,12 +508,10 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 		actions.IlmActionsCaster().Delete = &delete
 		del.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Delete = &del
-	} else {
+	} else if policy != nil && policy.Phases.Delete != nil {
-		if policy != nil && policy.Phases.Delete != nil {
 		// update
 		phases.PhasesCaster().Delete = policy.Phases.Delete
 	}
-	}
 
 	put := &putlifecycle.Request{}
 	newpolicy := &types.IlmPolicy{}
@@ -523,7 +522,7 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 
 	_, err = ilm.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed create ilm policy: %s", esErrorString(err))
+		return fmt.Errorf("failed create ilm policy: %w", esErrorString(err))
 	}
 
 	return nil

pkg/es/ilm_forecast.go

@@ -138,6 +138,7 @@ func IlmForecastList(conf *cfg.Config, filter string) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -154,14 +155,11 @@ func IlmForecastShow(conf *cfg.Config) error {
 	}
 
 	within := parseDuration(conf.Ilm.Within)
+
 	var toBeFreed int64 = 0
 
 	for _, phase := range phaseData {
-		age := virtualAge(&phase)
+		age := max(virtualAge(&phase), phase.age)
-
-		if age < phase.age {
-			age = phase.age
-		}
 
 		if age+within >= phase.minage {
 			toBeFreed += phase.size
@@ -196,24 +194,26 @@ func getIlmPhaseData(conf *cfg.Config) ([]PhaseData, error) {
 
 	wg.Wait()
 
-	var ilmdetails *explainlifecycle.Response
+	var (
-	var indicesres *indices.Response
+		ilmdetails  *explainlifecycle.Response
-	var ilmpolicies getlifecycle.Response
+		indicesres  *indices.Response
+		ilmpolicies getlifecycle.Response
+	)
 
-	for i := 0; i < 3; i++ {
+	for range 3 {
-		r := <-responses
+		res := <-responses
 
-		if r.error != nil {
+		if res.error != nil {
-			return nil, r.error
+			return nil, res.error
 		}
 
-		switch r.which {
+		switch res.which {
 		case ResponseExplain:
-			ilmdetails = r.explainlifecycle
+			ilmdetails = res.explainlifecycle
 		case ResponseIndices:
-			indicesres = r.indicesbytes
+			indicesres = res.indicesbytes
 		case ResponseLifecycle:
-			ilmpolicies = *r.lifecycle
+			ilmpolicies = *res.lifecycle
 		}
 	}
 

pkg/es/index.go

@@ -18,6 +18,8 @@ package es
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"regexp"
@@ -28,6 +30,7 @@ import (
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/charmbracelet/lipgloss"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/healthstatus"
@@ -37,9 +40,8 @@ import (
 func IndexNames(conf *cfg.Config) ([]string, error) {
 	res, err := conf.DefaultCluster.ES().Cat.Indices().
 		Do(context.Background())
-
 	if err != nil {
-		return nil, fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}
 
 	indices := make([]string, len(res))
@@ -97,7 +99,7 @@ func IndexList(conf *cfg.Config) error {
 
 	res, err := cat.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "indicies", res)
@@ -126,6 +128,7 @@ func IndexList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -133,13 +136,14 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {
 	res, err := conf.DefaultCluster.ES().Indices.Get(indexpattern).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get index: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index: %w", esErrorString(err))
 	}
 
 	slog.Debug("index show", "index", res)
 
 	for name, index := range res {
 		fields := make([]string, len(index.Mappings.Properties))
+
 		idx := 0
 		for field := range index.Mappings.Properties {
 			fields[idx] = field
@@ -195,6 +199,7 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 	if conf.Shards > 0 {
 		settings.NumberOfShards(strconv.Itoa(conf.Shards))
 	}
+
 	if conf.Replicas > 0 {
 		settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
 	}
@@ -232,9 +237,8 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 
 	_, err := create.Settings(settings).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create index: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index: %w", esErrorString(err))
 	}
 
 	return nil
@@ -244,7 +248,7 @@ func IndexDelete(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Indices.Delete(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete index: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index: %w", esErrorString(err))
 	}
 
 	return nil
@@ -253,9 +257,8 @@ func IndexDelete(conf *cfg.Config, index string) error {
 func IndexClose(conf *cfg.Config, index string) error {
 	_, err := conf.DefaultCluster.ES().Indices.Close(index).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to close index: %s", esErrorString(err))
+		return fmt.Errorf("failed to close index: %w", esErrorString(err))
 	}
 
 	return nil
@@ -267,13 +270,14 @@ func IndexFields(conf *cfg.Config, index string) error {
 		Fields("*").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve field capabilties: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve field capabilties: %w", esErrorString(err))
 	}
 
 	table := printer.NewTable(conf, 5, 0)
 	table.Addheaders("field", "type", "searchable", "aggretable", "metadata")
 
 	idx := 0
+
 	for name, field := range res.Fields {
 		for fieldtype, caps := range field {
 			// fields only have 1 type, so this one is it
@@ -305,3 +309,79 @@ func IndexFields(conf *cfg.Config, index string) error {
 
 	return nil
 }
+
+type Diskusage struct {
+	Total       int64 `json:"total_in_bytes"`
+	Points      int64 `json:"points_in_bytes"`
+	Norms       int64 `json:"norms_in_bytes"`
+	TermVectors int64 `json:"term_vectors_in_bytes"`
+	KnnVectors  int64 `json:"knn_vectors_in_bytes"`
+	BloomFilter int64 `json:"bloom_filter_in_bytes"`
+}
+
+type IndexDiskUsage struct {
+	AllFields Diskusage            `json:"all_fields"`
+	Fields    map[string]Diskusage `json:"fields"`
+}
+
+type ResIndexDiskUsage map[string]IndexDiskUsage
+
+func IndexDiskusage(conf *cfg.Config, index string) error {
+	var bold = lipgloss.NewStyle().Bold(true)
+
+	res, err := conf.DefaultCluster.ES().Indices.DiskUsage(index).
+		RunExpensiveTasks(true).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to retrieve index disk usage: %w", esErrorString(err))
+	}
+
+	duRes := ResIndexDiskUsage{}
+	if err := json.Unmarshal(res, &duRes); err != nil {
+		return fmt.Errorf("failed to unmarshal disk usage response: %w", err)
+	}
+
+	diskusage, exists := duRes[index]
+	if !exists {
+		return errors.New("no disk usage reported for index")
+	}
+
+	table := printer.NewTableEmpty(conf).
+		WithHeaders("field", "bloom filter", "norms", "points", "term vectors", "knn vectors", "total")
+
+	for name, field := range diskusage.Fields {
+		if strings.HasPrefix(name, "_") || strings.HasSuffix(name, ".keyword") {
+			continue
+		}
+
+		table.AddRow(
+			name,
+			printer.Bytes(field.BloomFilter),
+			printer.Bytes(field.Norms),
+			printer.Bytes(field.Points),
+			printer.Bytes(field.TermVectors),
+			printer.Bytes(field.KnnVectors),
+			printer.Bytes(field.Total),
+		)
+	}
+
+	all := diskusage.AllFields
+
+	table.Sort()
+
+	table.AddRowLate(
+		bold.Render("Summary"),
+		printer.Bytes(all.BloomFilter),
+		printer.Bytes(all.Norms),
+		printer.Bytes(all.Points),
+		printer.Bytes(all.TermVectors),
+		printer.Bytes(all.KnnVectors),
+		printer.Bytes(all.Total),
+	)
+
+	if err := table.Print(); err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/es/index_alias.go

@@ -35,7 +35,7 @@ func IndexAliasCreate(conf *cfg.Config, index, alias string) error {
 	slog.Debug("create alias", "result", res)
 
 	if err != nil {
-		return fmt.Errorf("failed to create index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index alias: %w", esErrorString(err))
 	}
 
 	return nil
@@ -52,9 +52,8 @@ func IndexAliasList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Indices.GetAlias().
 		Index("_all").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to list index aliases: %s", esErrorString(err))
+		return fmt.Errorf("failed to list index aliases: %w", esErrorString(err))
 	}
 
 	slog.Debug("aliases list", "result", res)
@@ -102,7 +101,7 @@ func IndexAliasDelete(conf *cfg.Config, index, alias string) error {
 	slog.Debug("delete alias", "result", res)
 
 	if err != nil {
-		return fmt.Errorf("failed to delete index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index alias: %w", esErrorString(err))
 	}
 
 	return nil
@@ -110,9 +109,8 @@ func IndexAliasDelete(conf *cfg.Config, index, alias string) error {
 
 func IndexAliasRollover(conf *cfg.Config, alias string) error {
 	res, err := RolloverAlias(conf, alias)
-
 	if err != nil {
-		return fmt.Errorf("failed to rollover index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to rollover index alias: %w", esErrorString(err))
 	}
 
 	table := printer.NewTable(conf, 2, 5)

pkg/es/index_template.go

@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"strconv"
 	"strings"
 
@@ -35,9 +36,8 @@ import (
 func IndexTemplateList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index templates: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index templates: %w", esErrorString(err))
 	}
 
 	slog.Debug("res", "index templates", res)
@@ -55,6 +55,7 @@ func IndexTemplateList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -62,9 +63,8 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {
 	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(tplname).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}
 
 	slog.Debug("res", "index template", res)
@@ -108,10 +108,11 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {
 
 	err = getIndexTemplateSettings(conf, tplname, table)
 	if err != nil {
-		return nil
+		return err
 	}
 
 	fmt.Println()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -136,6 +137,7 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {
 		}
 
 		fmt.Println()
+
 		if err := table.Print(); err != nil {
 			return err
 		}
@@ -223,9 +225,8 @@ func IndexTemplateCreate(conf *cfg.Config, name string, mappings []string) error
 	create.IndexPatterns(conf.Patterns...)
 
 	_, err := create.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index template: %w", esErrorString(err))
 	}
 
 	return nil
@@ -240,9 +241,8 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(name).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}
 
 	slog.Debug("res", "index template", res)
@@ -334,9 +334,8 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 	modify.IndexPatterns(patterns...)
 
 	_, err = modify.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to modify index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to modify index template: %w", esErrorString(err))
 	}
 
 	if conf.Rollover {
@@ -352,7 +351,7 @@ func IndexTemplateDelete(conf *cfg.Config, name string) error {
 	_, err := conf.DefaultCluster.ES().Indices.DeleteIndexTemplate(name).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index template: %w", esErrorString(err))
 	}
 
 	return nil
@@ -365,9 +364,8 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
 	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(name).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}
 
 	slog.Debug("res", "index template", res)
@@ -384,7 +382,7 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
 		res, err := conf.DefaultCluster.ES().Indices.ResolveIndex(pattern).
 			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to resolve index pattern: %s", esErrorString(err))
+			return fmt.Errorf("failed to resolve index pattern: %w", esErrorString(err))
 		}
 
 		for _, index := range res.Indices {
@@ -416,7 +414,6 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
 	}
 
 	return nil
-
 }
 
 func modMappings(mappings []string) (types.TypeMappingVariant, error) {
@@ -448,9 +445,7 @@ func modMappings(mappings []string) (types.TypeMappingVariant, error) {
 func modMeta(conf *cfg.Config, meta types.Metadata) (map[string]json.RawMessage, error) {
 	metadata := map[string]json.RawMessage{}
 
-	for key, value := range meta {
+	maps.Copy(metadata, meta)
-		metadata[key] = value
-	}
 
 	for _, meta := range conf.Meta {
 		parts := strings.Split(meta, ":")

pkg/es/index_template_settings.go

@@ -43,6 +43,7 @@ func getIndexTemplateSettings(conf *cfg.Config, tplname string, table *printer.T
 		if err != nil {
 			return err
 		}
+
 		fmt.Println(output)
 	}
 

pkg/es/license.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"strconv"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
@@ -29,7 +30,7 @@ func LicenseShow(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().License.Get().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get license: %s", esErrorString(err))
+		return fmt.Errorf("failed to get license: %w", esErrorString(err))
 	}
 
 	slog.Debug("license show", "license", res)
@@ -38,12 +39,14 @@ func LicenseShow(conf *cfg.Config) error {
 
 	lic := res.License
 
-	var maxnodes = "infinite"
+	var (
-	var maxunits = "infinite"
+		maxnodes = "infinite"
-	var expire = "never"
+		maxunits = "infinite"
+		expire   = "never"
+	)
 
 	if lic.MaxNodes != nil {
-		maxnodes = fmt.Sprintf("%d", *lic.MaxNodes)
+		maxnodes = strconv.FormatInt(*lic.MaxNodes, 10)
 	}
 
 	if lic.ExpiryDate != nil {
@@ -51,7 +54,7 @@ func LicenseShow(conf *cfg.Config) error {
 	}
 
 	if lic.MaxResourceUnits != nil {
-		maxunits = fmt.Sprintf("%d", *lic.MaxResourceUnits)
+		maxunits = strconv.Itoa(*lic.MaxResourceUnits)
 	}
 
 	table.Entries = [][]any{

pkg/es/node.go

@@ -20,28 +20,28 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"strconv"
 	"strings"
 	"time"
 
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
-	"github.com/dustin/go-humanize"
 )
 
 func NodeList(conf *cfg.Config) error {
 	// get nodes
 	nodes, err := conf.DefaultCluster.ES().Cat.Nodes().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get nodes: %s", esErrorString(err))
+		return fmt.Errorf("failed to get nodes: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "nodes", nodes)
 
-	table := printer.NewTable(conf, 7, len(nodes))
+	table := printer.NewTableEmpty(conf).WithHeaders(
-	table.Addheaders("name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
+		"name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
 
-	for idx, node := range nodes {
+	for _, node := range nodes {
-		table.Entries[idx] = []any{
+		table.AddRow(
 			*node.Name,
 			*node.Ip,
 			*node.Load1M,
@@ -49,10 +49,11 @@ func NodeList(conf *cfg.Config) error {
 			*node.Load15M,
 			node.RamPercent,
 			node.HeapPercent,
-		}
+		)
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -64,7 +65,7 @@ func NodeNames(conf *cfg.Config) ([]string, error) {
 	nodes, err := conf.DefaultCluster.ES().Cat.Nodes().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get nodes: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get nodes: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "nodes", nodes)
@@ -86,7 +87,7 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 		Metric("os, jvm, thread_pool, remote_cluster_server").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get node info: %s", esErrorString(err))
+		return fmt.Errorf("failed to get node info: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "node", res)
@@ -95,7 +96,7 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 		NodeId(nodename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get node stats: %s", esErrorString(err))
+		return fmt.Errorf("failed to get node stats: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "stat", stats)
@@ -112,18 +113,27 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 		}
 
 		k8snode := info.Attributes["k8s_node_name"]
+		rank := "none"
+
+		adsel, exists := stat.AdaptiveSelection[id]
+		if exists {
+			rank = *adsel.Rank
+		}
 
 		table.Entries = [][]any{
 			{"Id", id},
 			{"Name", nodename},
 			{"Kubernetes node", k8snode},
 			{"Ip address", info.Ip},
-			{"Node rank", *stat.AdaptiveSelection[id].Rank},
+			{"Node rank", rank},
 			{"JVM", info.Jvm.VmName + " " + info.Jvm.Version},
 			{"JVM Started", time.UnixMilli(info.Jvm.StartTimeInMillis)},
 			{"OS", info.Os.PrettyName + " " + info.Os.Version},
 			{"Node roles", roles},
 			{"Node version", info.Version},
+			// FIXME: not implemented upstream
+			// see: https://github.com/elastic/go-elasticsearch/issues/1526
+			// {"Allocated shards", stat.Allocations.XXX},
 			{"HTTP clients", *stat.Http.CurrentOpen},
 			{"CPUs", *info.Os.AllocatedProcessors},
 			{"Load 15m/5m/1m", fmt.Sprintf("%.2f/%.2f/%.2f",
@@ -132,18 +142,41 @@ func NodeShow(conf *cfg.Config, nodename string) error {
 				stat.Os.Cpu.LoadAverage["1m"],
 			)},
 			{"Open FD's", *stat.Process.OpenFileDescriptors},
-			{"Response time avg", fmt.Sprintf("%dns", *stat.AdaptiveSelection[id].AvgResponseTimeNs)},
+			{"HTTP sesssions current/total", fmt.Sprintf("%d/%d",
+				*stat.Http.CurrentOpen,
+				*stat.Http.TotalOpened,
+			)},
+			{"Traffic rx/tx",
+				printer.ByteString(*stat.Transport.RxSizeInBytes) + " / " + printer.ByteString(*stat.Transport.TxSizeInBytes)},
+			{"Response time avg", time.Duration(*stat.AdaptiveSelection[id].AvgResponseTimeNs)},
 			{"Memory usage (used/avail)",
-				humanize.Bytes(uint64(*stat.Os.Mem.UsedInBytes)) + " / " + humanize.Bytes(uint64(*stat.Os.Mem.TotalInBytes))},
+				printer.ByteString(*stat.Os.Mem.UsedInBytes) + " / " + printer.ByteString(*stat.Os.Mem.TotalInBytes)},
+			{"Search queries current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Search.QueryCurrent,
+				stat.Indices.Search.QueryTotal,
+			)},
+			{"Search efficiency", stat.Indices.Search.QueryTimeInMillis / stat.Indices.Search.QueryTotal},
+			{"Docs count", stat.Indices.Docs.Count},
+			{"Merges current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Merges.Current,
+				stat.Indices.Merges.Total,
+			)},
+			{"Merge docs count current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Merges.CurrentDocs,
+				stat.Indices.Merges.TotalDocs,
+			)},
+			{"Merge size current/total", fmt.Sprintf("%s/%s",
+				printer.ByteString(stat.Indices.Merges.CurrentSizeInBytes),
+				printer.ByteString(stat.Indices.Merges.TotalSizeInBytes),
+			)},
+			{"CircuitBreaker trip count", *stat.Breakers["fielddata"].Tripped},
 		}
 
 		if len(stat.Fs.Data) > 0 {
 			fs := stat.Fs.Data[0]
-			table.Entries = append(table.Entries, [][]any{
+			table.AddRow("Storage usage (used/avail)",
-				{"Storage usage (used/avail)",
+				printer.ByteString(*fs.AvailableInBytes)+" / "+printer.ByteString(*fs.TotalInBytes))
-					humanize.Bytes(uint64(*fs.AvailableInBytes)) + " / " + humanize.Bytes(uint64(*fs.TotalInBytes))},
+			table.AddRow("Storage mount", *fs.Mount)
-				{"Storage mount", *fs.Mount},
-			}...)
 		}
 
 		if err := table.Print(); err != nil {
@@ -159,7 +192,7 @@ func NodeClients(conf *cfg.Config, nodename string) error {
 		NodeId(nodename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get node stats: %s", esErrorString(err))
+		return fmt.Errorf("failed to get node stats: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "stat", stats)
@@ -187,7 +220,7 @@ func NodeClients(conf *cfg.Config, nodename string) error {
 
 				table.AddRow(
 					agent,
-					fmt.Sprintf("%d", *client.Id),
+					strconv.FormatInt(*client.Id, 10),
 					time.UnixMilli(*client.LastRequestTimeMillis).String(),
 					*client.RemoteAddress,
 					uri,
@@ -199,5 +232,75 @@ func NodeClients(conf *cfg.Config, nodename string) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
+
+func NodeUsage(conf *cfg.Config, nodeid string) error {
+	usage := conf.DefaultCluster.ES().Nodes.Usage()
+
+	if nodeid != "" {
+		usage.NodeId(nodeid)
+	}
+
+	stats, err := usage.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get node usage: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "usage", stats)
+
+	table := printer.NewTableEmpty(conf).WithHeaders(
+		"node",
+		"bulk",
+		"doc get",
+		"doc mget",
+		"doc update",
+		"index doc",
+		"index stats",
+		"search",
+		"msearch",
+		"open pit",
+	)
+
+	for id, actions := range stats.Nodes {
+		node, err := getNodeName(conf, id)
+		if err != nil {
+			return err
+		}
+
+		stat := actions.RestActions
+
+		table.AddRow(
+			node,
+			stat["bulk_action"],
+			stat["document_get_action"],
+			stat["document_mget_action"],
+			stat["document_update_action"],
+			stat["document_index_action"],
+			stat["indices_stats_action"],
+			stat["search_action"],
+			stat["msearch_action"],
+			stat["open_point_in_time"],
+		)
+	}
+
+	return table.Print()
+}
+
+func getNodeName(conf *cfg.Config, id string) (string, error) {
+	res, err := conf.DefaultCluster.ES().Nodes.Info().
+		Metric("os").
+		Do(context.Background())
+	if err != nil {
+		return "", fmt.Errorf("failed to get node info: %w", esErrorString(err))
+	}
+
+	for nodeid, node := range res.Nodes {
+		if id == nodeid {
+			return node.Name, nil
+		}
+	}
+
+	return "", nil
+}

pkg/es/parallel.go

@@ -69,7 +69,8 @@ func getApiData(
 	which string) {
 	defer wg.Done()
 
-	ar := apiResponse{}
+	apiRes := apiResponse{}
+
 	var arerr error
 
 	switch which {
@@ -77,47 +78,47 @@ func getApiData(
 		res, err := es.Cluster.Health().
 			Do(context.Background())
 
-		ar.health = res
+		apiRes.health = res
-		ar.which = ResponseHealth
+		apiRes.which = ResponseHealth
 		arerr = err
 
 	case "healthreport":
 		report, err := getHealthReport(conf)
 
-		ar.healthreport = report
+		apiRes.healthreport = report
-		ar.which = ResponseHealthReport
+		apiRes.which = ResponseHealthReport
 		arerr = err
 
 	case "info":
 		res, err := es.Info().
 			Do(context.Background())
 
-		ar.info = res
+		apiRes.info = res
-		ar.which = ResponseInfo
+		apiRes.which = ResponseInfo
 		arerr = err
 
 	case "ccr":
 		res, err := es.Ccr.Stats().
 			Do(context.Background())
 
-		ar.ccr = res
+		apiRes.ccr = res
-		ar.which = ResponseCcr
+		apiRes.which = ResponseCcr
 		arerr = err
 
 	case "stats":
 		res, err := es.Cluster.Stats().
 			Do(context.Background())
 
-		ar.stats = res
+		apiRes.stats = res
-		ar.which = ResponseStats
+		apiRes.which = ResponseStats
 		arerr = err
 
 	case "indices":
 		res, err := es.Cat.Indices().
 			Do(context.Background())
 
-		ar.indices = &res
+		apiRes.indices = &res
-		ar.which = ResponseIndices
+		apiRes.which = ResponseIndices
 		arerr = err
 
 	case "indicesbytes":
@@ -126,16 +127,16 @@ func getApiData(
 			Bytes(bytes.Bytes{Name: "b"}).
 			Do(context.Background())
 
-		ar.indicesbytes = &res
+		apiRes.indicesbytes = &res
-		ar.which = ResponseIndices
+		apiRes.which = ResponseIndices
 		arerr = err
 
 	case "tasks":
 		res, err := es.Cat.Tasks().
 			Do(context.Background())
 
-		ar.tasks = &res
+		apiRes.tasks = &res
-		ar.which = ResponseTasks
+		apiRes.which = ResponseTasks
 		arerr = err
 
 	case "explain":
@@ -143,8 +144,8 @@ func getApiData(
 			ExplainLifecycle("_all").
 			Do(context.Background())
 
-		ar.explainlifecycle = res
+		apiRes.explainlifecycle = res
-		ar.which = ResponseExplain
+		apiRes.which = ResponseExplain
 		arerr = err
 
 	case "policies":
@@ -152,14 +153,14 @@ func getApiData(
 			GetLifecycle().
 			Do(context.Background())
 
-		ar.lifecycle = &res
+		apiRes.lifecycle = &res
-		ar.which = ResponseLifecycle
+		apiRes.which = ResponseLifecycle
 		arerr = err
 	}
 
 	if arerr != nil {
-		ar.error = fmt.Errorf("failed to get data from API: %s", arerr)
+		apiRes.error = fmt.Errorf("failed to get data from API: %w", arerr)
 	}
 
-	reschan <- ar
+	reschan <- apiRes
 }

pkg/es/role.go

@@ -30,10 +30,11 @@ func RoleNames(conf *cfg.Config) ([]string, error) {
 	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}
 
 	roles := make([]string, len(res))
+
 	idx := 0
 	for name := range res {
 		roles[idx] = name
@@ -47,7 +48,7 @@ func RoleList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "roles", res)
@@ -66,6 +67,7 @@ func RoleList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -74,7 +76,7 @@ func RoleShow(conf *cfg.Config, rolename string) error {
 		Name(rolename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+		return fmt.Errorf("failed to get role: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "role", res)
@@ -132,7 +134,9 @@ func roleRemoteClusters(conf *cfg.Config, role types.Role) error {
 
 	table := printer.NewTable(conf, 2, len(role.RemoteCluster))
 	table.Addheaders("remote cluster", "privilege")
+
 	idx := 0
+
 	for _, priv := range role.RemoteCluster {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
@@ -145,6 +149,7 @@ func roleRemoteClusters(conf *cfg.Config, role types.Role) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -155,6 +160,7 @@ func roleClusters(conf *cfg.Config, role types.Role) error {
 
 	table := printer.NewTable(conf, 1, len(role.Cluster))
 	table.Addheaders("cluster rights")
+
 	idx := 0
 	for _, cluster := range role.Cluster {
 		table.Entries[idx] = []any{cluster.Name}
@@ -162,6 +168,7 @@ func roleClusters(conf *cfg.Config, role types.Role) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -172,7 +179,9 @@ func roleRemoteIndices(conf *cfg.Config, role types.Role) error {
 
 	table := printer.NewTable(conf, 3, len(role.RemoteIndices))
 	table.Addheaders("remote index names", "index permissions", "allow restricted")
+
 	idx := 0
+
 	for _, priv := range role.RemoteIndices {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
@@ -185,6 +194,7 @@ func roleRemoteIndices(conf *cfg.Config, role types.Role) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -195,7 +205,9 @@ func roleIndices(conf *cfg.Config, role types.Role) error {
 
 	table := printer.NewTable(conf, 3, len(role.Indices))
 	table.Addheaders("index names", "index permissions", "allow restricted")
+
 	idx := 0
+
 	for _, priv := range role.Indices {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
@@ -208,6 +220,7 @@ func roleIndices(conf *cfg.Config, role types.Role) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }
 
@@ -218,6 +231,7 @@ func roleApplications(conf *cfg.Config, role types.Role) error {
 
 	table := printer.NewTable(conf, 3, len(role.Applications))
 	table.Addheaders("application", "privileges", "resources")
+
 	idx := 0
 	for _, priv := range role.Applications {
 		table.Entries[idx] = []any{
@@ -230,5 +244,6 @@ func roleApplications(conf *cfg.Config, role types.Role) error {
 	}
 
 	table.Sort()
+
 	return table.Print()
 }

pkg/es/role_diff.go

@@ -75,7 +75,7 @@ type Register struct {
 func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error) {
 	data, err := os.ReadFile(csvfile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read CSV file: %s", err)
+		return nil, fmt.Errorf("failed to read CSV file: %w", err)
 	}
 
 	csvreader := csv.NewReader(bytes.NewReader(data))
@@ -85,7 +85,7 @@ func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error)
 
 	rows, err := csvreader.ReadAll()
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse CSV: %s", err)
+		return nil, fmt.Errorf("failed to parse CSV: %w", err)
 	}
 
 	records := make(map[string]Record, len(rows)-1)
@@ -118,7 +118,7 @@ func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error)
 func getCsvRecord(conf *cfg.Config, csvfile, rolename string) (*Record, error) {
 	fd, err := os.Open(csvfile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to open CSV file: %s", err)
+		return nil, fmt.Errorf("failed to open CSV file: %w", err)
 	}
 	defer func() {
 		if err := fd.Close(); err != nil {
@@ -179,6 +179,7 @@ func diffRoles(conf *cfg.Config, records map[string]Record, res getrole.Response
 	// iterate over records from CSV and register only those which are not deployed
 	for name := range records {
 		reg := Register{name: name, defined: true}
+
 		_, deployed := deployed[name]
 		if !deployed {
 			rows = append(rows, reg)
@@ -210,7 +211,7 @@ func RoleDiff(conf *cfg.Config, csvfile, role string) error {
 	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}
 
 	rows := diffRoles(conf, records, res)
@@ -245,10 +246,11 @@ func getRoleMappingGroups(conf *cfg.Config, rolename string) ([]string, error) {
 	mappings, err := conf.DefaultCluster.ES().Security.GetRoleMapping().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get role mappings: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get role mappings: %w", esErrorString(err))
 	}
 
 	groups := []string{}
+
 	for _, mapping := range mappings {
 		if slices.Contains(mapping.Roles, rolename) {
 			for _, rule := range mapping.Rules.Any {
@@ -262,13 +264,13 @@ func getRoleMappingGroups(conf *cfg.Config, rolename string) ([]string, error) {
 	return groups, nil
 }
 
-func compareSlices(name string, a, b []string) {
+func compareSlices(name string, left, right []string) {
-	slices.Sort(a)
+	slices.Sort(left)
-	slices.Sort(b)
+	slices.Sort(right)
 
-	if slices.Compare(a, b) != 0 {
+	if slices.Compare(left, right) != 0 {
 		fmt.Printf("%s differs:\ndeployed: %s\n     csv: %s\n",
-			name, strings.Join(a, ","), strings.Join(b, ","))
+			name, strings.Join(left, ","), strings.Join(right, ","))
 	} else {
 		fmt.Printf("deployed %s matches csv definition\n", name)
 	}
@@ -279,7 +281,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 		Name(rolename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+		return fmt.Errorf("failed to get role: %w", esErrorString(err))
 	}
 
 	record, err := getCsvRecord(conf, csvfile, rolename)
@@ -289,16 +291,19 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 
 	if !record.defined {
 		fmt.Printf("role %s is not defined\n", rolename)
+
 		return nil
 	}
 
 	role, exists := res[rolename]
 	if !exists {
 		fmt.Printf("role %s is not deployed\n", rolename)
+
 		return nil
 	} else {
 		fmt.Printf("role %s is deployed\n", rolename)
 	}
+
 	slog.Debug("found role", "role", role)
 
 	if conf.Debug {
@@ -310,6 +315,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 	if err != nil {
 		return err
 	}
+
 	slog.Debug("group mappings", "groups", groups)
 
 	// check cluster setting
@@ -321,6 +327,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 	// check index names+privs
 	indices := []string{}
 	privs := []string{}
+
 	for _, index := range role.Indices {
 		for _, name := range index.Names {
 			indices = append(indices, strings.ReplaceAll(name, "**", "*"))
@@ -333,6 +340,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 
 	// check kibana application space
 	spaces := []string{}
+
 	for _, app := range role.Applications {
 		for _, resource := range app.Resources {
 			if strings.Contains(resource, "space:") {

pkg/es/rollover.go

@@ -31,14 +31,17 @@ func RolloverConditions(conf *cfg.Config) types.RolloverConditionsVariant {
 	if conf.MaxAge != "" {
 		cond.MaxAge(esdsl.NewDuration().String(conf.MaxAge))
 	}
+
 	if conf.MaxDocs > 0 {
 		cond.MaxDocs(int64(conf.MaxDocs))
 	}
+
 	if conf.MaxShardSize > 0 {
 		bs := esdsl.NewByteSize()
 		bs.Int64(int64(conf.MaxShardSize))
 		cond.MaxPrimaryShardSize(bs)
 	}
+
 	if conf.MaxShardDocs > 0 {
 		cond.MaxPrimaryShardDocs(int64(conf.MaxShardDocs))
 	}

pkg/es/search.go

@@ -82,13 +82,13 @@ func explainSearch(conf *cfg.Config, search *search.Search) error {
 		Size(1). // one's enough for explain
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to call explain search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to call explain search (esdsl): %w", esErrorString(err))
 	}
 
 	if conf.Debug {
 		raw, err := json.Marshal(res)
 		if err != nil {
-			return fmt.Errorf("failed to marshal explain result: %s", err)
+			return fmt.Errorf("failed to marshal explain result: %w", err)
 		}
 
 		value := gjson.Get(string(raw), "hits.hits.0._explanation")
@@ -111,6 +111,7 @@ func explainSearch(conf *cfg.Config, search *search.Search) error {
 
 func explain(res *types.ExplanationDetail, indent string) {
 	fmt.Println(indent + "- " + res.Description)
+
 	for _, ex := range res.Details {
 		fmt.Println(indent + "  - " + ex.Description)
 		fmt.Println(indent + fmt.Sprintf("    score: %f", res.Value))
@@ -134,7 +135,7 @@ func validateSearch(conf *cfg.Config, queries []string) error {
 	res, err := validate.
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to validate search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to validate search (esdsl): %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "search", res)
@@ -154,7 +155,7 @@ func searchOnce(conf *cfg.Config, search *search.Search) error {
 		Size(conf.To).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to run search (esdsl): %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "search", res)
@@ -167,9 +168,10 @@ func searchOnce(conf *cfg.Config, search *search.Search) error {
 // https://www.elastic.co/docs/reference/elasticsearch/clients/go/using-the-api/searching#_pit_search_after
 func searchPit(conf *cfg.Config, req *search.Request) error {
 	ctx := context.Background()
+
 	pit, err := conf.DefaultCluster.ES().OpenPointInTime(conf.Index).KeepAlive("1m").Do(ctx)
 	if err != nil {
-		return fmt.Errorf("failed to open point-in-time request for search: %s", err)
+		return fmt.Errorf("failed to open point-in-time request for search: %w", err)
 	}
 	defer func() {
 		_, err := conf.DefaultCluster.ES().ClosePointInTime().Id(pit.Id).Do(ctx)
@@ -192,7 +194,7 @@ func searchPit(conf *cfg.Config, req *search.Request) error {
 	for {
 		res, err := search.Do(ctx)
 		if err != nil {
-			return fmt.Errorf("failed to run search (esdsl pit): %s", esErrorString(err))
+			return fmt.Errorf("failed to run search (esdsl pit): %w", esErrorString(err))
 		}
 
 		if len(res.Hits.Hits) == 0 {
@@ -222,7 +224,7 @@ func searchTail(conf *cfg.Config, search *search.Search) error {
 	for {
 		res, err := search.Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
+			return fmt.Errorf("failed to run search (esdsl): %w", esErrorString(err))
 		}
 
 		slog.Debug("ES result", "search", res)

pkg/es/search_filter.go

@@ -63,6 +63,7 @@ type filter struct {
 // must match literally, and range filters using -r "@timestamp:2026-05-28T10:00:00 to now"
 func NewFilter(query string) (*filter, error) {
 	var separator string
+
 	var criteria int // we use the constants on top for this
 
 	switch {
@@ -76,7 +77,7 @@ func NewFilter(query string) (*filter, error) {
 
 	part := strings.Split(query, separator)
 	if len(part) != 2 {
-		return nil, fmt.Errorf("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
+		return nil, errors.New("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
 	}
 
 	flt := &filter{term: part[0], filter: part[1], criteria: criteria}
@@ -234,7 +235,6 @@ func addFilters(conf *cfg.Config) ([]types.QueryVariant, error) {
 		}
 
 		filters[count-1] = rng
-
 	}
 
 	return filters, nil
@@ -247,7 +247,6 @@ func addSort(conf *cfg.Config, search *search.Search) *search.Search {
 		Index(conf.Index).
 		Fields(conf.SortBy).
 		Do(context.Background())
-
 	if err != nil {
 		// whatever it was, do not add Sort()
 		slog.Debug("get field capabilities", "field", conf.SortBy, "error", esErrorString(err))

pkg/es/searchql.go

@@ -0,0 +1,79 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+)
+
+type searchQlColumn struct {
+	Name string `json:"name"`
+	Type string `json:"type"`
+}
+
+type searchQlResult struct {
+	Partial bool             `json:"is_partial"`
+	Docs    int              `json:"documents_found"`
+	Columns []searchQlColumn `json:"columns"`
+	Values  [][]any          `json:"values"`
+}
+
+func SearchQL(conf *cfg.Config, querystring string) error {
+	query := conf.DefaultCluster.ES().Esql.Query().
+		Query(querystring).
+		DropNullColumns(true)
+
+	res, err := query.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to run esql query: %w", esErrorString(err))
+	}
+
+	if conf.Debug {
+		fmt.Println(string(res))
+	}
+
+	qlResult := searchQlResult{}
+
+	if err = json.Unmarshal(res, &qlResult); err != nil {
+		return fmt.Errorf("failed to unmarshal esql result: %w", err)
+	}
+
+	slog.Debug("searchql result", "qlres", qlResult)
+
+	if qlResult.Docs == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, len(qlResult.Columns), len(qlResult.Values))
+
+	headers := make([]string, len(qlResult.Columns))
+	for idx, col := range qlResult.Columns {
+		headers[idx] = col.Name
+	}
+
+	table.Addheaders(headers...)
+
+	table.Entries = qlResult.Values
+
+	return table.Print()
+}

pkg/es/shard.go

@@ -40,8 +40,7 @@ func colorzizeShard(conf *cfg.Config, state, name string) string {
 }
 
 func resolvePrirep(state string) string {
-	switch state {
+	if state == "p" {
-	case "p":
 		return "primary"
 	}
 
@@ -86,7 +85,7 @@ func ShardList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Cat.Shards().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
+		return fmt.Errorf("failed to get shards: %w", esErrorString(err))
 	}
 
 	shardlist := filterShards(conf, res)
@@ -125,6 +124,7 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -136,7 +136,7 @@ func ShardShow(conf *cfg.Config, index string) error {
 	res, err := conf.DefaultCluster.ES().Cat.Shards().Index(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
+		return fmt.Errorf("failed to get shards: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "shards", res)
@@ -158,33 +158,40 @@ func ShardAllocation(conf *cfg.Config, index string) error {
 
 	res, err := explain.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shard allocation explain: %s", esErrorString(err))
+		return fmt.Errorf("failed to get shard allocation explain: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "explain", res)
 
-	currentNode := res.CurrentNode
-
 	table := printer.NewTable(conf, 2, 10)
 	table.Addheaders("shard allocation setting", "value")
 
-	roles := make([]string, len(currentNode.Roles))
-	for idx, role := range currentNode.Roles {
-		roles[idx] = role.Name
-	}
-
 	table.Entries = [][]any{
 		{"Index", index},
 		{"Current state", res.CurrentState},
+		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
+		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
+		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
+	}
+
+	if res.CurrentNode != nil {
+		currentNode := res.CurrentNode
+		roles := make([]string, len(currentNode.Roles))
+
+		for idx, role := range currentNode.Roles {
+			roles[idx] = role.Name
+		}
+
+		table.Entries = append(table.Entries, [][]any{
 			{"Current node", currentNode.Name},
 			{"Current k8s node", currentNode.Attributes["k8s_node_name"]},
 			{"Current node address", currentNode.TransportAddress},
 			{"Current node id", currentNode.Id},
 			{"Current node weight", currentNode.WeightRanking},
 			{"Current node roles", roles},
-		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
+		}...)
-		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
+	} else {
-		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
+		table.AddRow("Current node", "not currently assigned to any node")
 	}
 
 	if res.CurrentState == "unassigned" {

pkg/es/snapshot.go

@@ -45,7 +45,7 @@ func SnapshotList(conf *cfg.Config) error {
 	// get partial indicies
 	ires, err := conf.DefaultCluster.ES().Cat.Indices().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}
 
 	indicies := map[string]int{}
@@ -58,7 +58,7 @@ func SnapshotList(conf *cfg.Config) error {
 	// get snapshots
 	sres, err := conf.DefaultCluster.ES().Cat.Snapshots().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshots: %s", esErrorString(err))
+		return fmt.Errorf("failed to get snapshots: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "indicies", sres)
@@ -98,6 +98,7 @@ func SnapshotList(conf *cfg.Config) error {
 	}
 
 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -108,7 +109,7 @@ func SnapshotList(conf *cfg.Config) error {
 func SnapshotShow(conf *cfg.Config, snapshot string) error {
 	res, err := conf.DefaultCluster.ES().Snapshot.Get("*", snapshot).Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshot: %s", esErrorString(err))
+		return fmt.Errorf("failed to get snapshot: %w", esErrorString(err))
 	}
 
 	slog.Debug("ES result", "snapshot", res)

pkg/es/task.go

@@ -30,15 +30,15 @@ import (
 func TaskList(conf *cfg.Config) error {
 	res, err := conf.DefaultCluster.ES().Cat.Tasks().
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index templates: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index templates: %w", esErrorString(err))
 	}
 
 	slog.Debug("res", "tasks", res)
 
 	table := printer.NewTable(conf, 8, len(res))
 	table.Addheaders("task id", "action", "start time", "run time", "node", "type")
+
 	for idx, task := range res {
 		var ts time.Time
 
@@ -66,9 +66,8 @@ func TaskCancel(conf *cfg.Config, taskid string) error {
 	_, err := conf.DefaultCluster.ES().Tasks.Cancel().
 		TaskId(taskid).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to cancel task: %s", esErrorString(err))
+		return fmt.Errorf("failed to cancel task: %w", esErrorString(err))
 	}
 
 	return nil

pkg/printer/bytes.go

@@ -22,10 +22,16 @@ type ByteSize struct {
 	size uint64
 }
 
-func Bytes(size int64) ByteSize {
-	return ByteSize{size: uint64(size)}
-}
-
 func (b *ByteSize) String() string {
 	return humanize.Bytes(b.size)
 }
+
+func Bytes(size int64) *ByteSize {
+	return &ByteSize{size: uint64(size)}
+}
+
+func ByteString(size int64) string {
+	b := ByteSize{size: uint64(size)}
+
+	return b.String()
+}

pkg/printer/cast.go

@@ -26,6 +26,7 @@ import (
 )
 
 func any2string(in any) string {
+	//nolint:gocritic
 	switch val := in.(type) {
 	case string:
 		return val
@@ -37,18 +38,24 @@ func any2string(in any) string {
 		return strconv.Itoa(val)
 	case float64:
 		return fmt.Sprintf("%.2f", val)
+	case float32:
+		return fmt.Sprintf("%.2f", val)
 	case []string:
 		return strings.Join(val, ",")
 	case ByteSize:
 		return val.String()
+	case *ByteSize:
+		return val.String()
 	case time.Time:
 		return val.Format("2006-01-02 15:04:05")
+	case time.Duration:
+		return val.String()
 	case []byte:
 		return string(val)
-	case types.DateTime, types.Percentage:
-		return val.(string)
 	case nil:
 		return "null"
+	case types.Percentage, types.DateTime:
+		return val.(string)
 	}
 
 	return ""
@@ -78,6 +85,7 @@ func (data *Table) preprocessRows() {
 	// determine max width per column
 	for _, entries := range data.rows {
 		currentWidth := 0
+
 		for idx, entry := range entries {
 			length := visibleLen(entry)
 

pkg/printer/doc.go

@@ -33,7 +33,6 @@ func PrintDocs(conf *cfg.Config, hits []types.Hit) {
 	for _, hit := range hits {
 		PrintDoc(conf, hit)
 	}
-
 }
 
 func PrintDoc(conf *cfg.Config, hit types.Hit) {

pkg/printer/pager.go

@@ -34,12 +34,14 @@ var (
 	titleStyle = func() lipgloss.Style {
 		b := lipgloss.RoundedBorder()
 		b.Right = "├"
+
 		return lipgloss.NewStyle().BorderStyle(b).Padding(0, 1)
 	}()
 
 	infoStyle = func() lipgloss.Style {
 		b := lipgloss.RoundedBorder()
 		b.Left = "┤"
+
 		return titleStyle.BorderStyle(b)
 	}()
 )
@@ -56,10 +58,9 @@ func (m model) Init() tea.Cmd {
 }
 
 func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	var (
+	var cmd tea.Cmd
-		cmd  tea.Cmd
+
-		cmds []tea.Cmd
+	cmds := make([]tea.Cmd, 1)
-	)
 
 	switch msg := msg.(type) {
 	case tea.KeyMsg:
@@ -90,7 +91,7 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	// Handle keyboard and mouse events in the viewport
 	m.viewport, cmd = m.viewport.Update(msg)
-	cmds = append(cmds, cmd)
+	cmds[0] = cmd
 
 	return m, tea.Batch(cmds...)
 }
@@ -99,6 +100,7 @@ func (m model) View() string {
 	if !m.ready {
 		return "\n  Initializing..."
 	}
+
 	return fmt.Sprintf("%s\n%s\n%s", m.headerView(), m.viewport.View(), m.footerView())
 }
 
@@ -106,30 +108,25 @@ func (m model) headerView() string {
 	// title := titleStyle.Render("RPN Help Overview")
 	title := titleStyle.Render(m.title)
 	line := strings.Repeat("─", max(0, m.viewport.Width-lipgloss.Width(title)))
+
 	return lipgloss.JoinHorizontal(lipgloss.Center, title, line)
 }
 
 func (m model) footerView() string {
 	info := infoStyle.Render(fmt.Sprintf("%3.f%%", m.viewport.ScrollPercent()*100))
 	line := strings.Repeat("─", max(0, m.viewport.Width-lipgloss.Width(info)))
+
 	return lipgloss.JoinHorizontal(lipgloss.Center, line, info)
 }
 
-func max(a, b int) int {
-	if a > b {
-		return a
-	}
-	return b
-}
-
 func Pager(title, message string) {
-	p := tea.NewProgram(
+	pager := tea.NewProgram(
 		model{content: message, title: title},
 		tea.WithAltScreen(),       // use the full size of the terminal in its "alternate screen buffer"
 		tea.WithMouseCellMotion(), // turn on mouse support so we can track the mouse wheel
 	)
 
-	if _, err := p.Run(); err != nil {
+	if _, err := pager.Run(); err != nil {
 		fmt.Println("could not run pager:", err)
 		os.Exit(1)
 	}

pkg/printer/table.go

@@ -32,6 +32,7 @@ import (
 type Table struct {
 	Mode       string // tsv, json, yaml
 	Headers    []string
+	RawHeaders []string
 	Entries    [][]any
 
 	rows       [][]string // representation used for printing
@@ -45,6 +46,7 @@ func NewTable(conf *cfg.Config, columns, rows int) *Table {
 	table := Table{Mode: conf.Output, maxwidth: cfg.GetTermWidth()}
 
 	table.Headers = make([]string, columns)
+	table.RawHeaders = make([]string, columns)
 	table.Entries = make([][]any, rows)
 	table.lenHeaders = make([]int, columns)
 	table.alignInts = conf.AlignInts
@@ -55,6 +57,7 @@ func NewTable(conf *cfg.Config, columns, rows int) *Table {
 func NewTableEmpty(conf *cfg.Config) *Table {
 	table := Table{Mode: conf.Output, maxwidth: cfg.GetTermWidth()}
 	table.alignInts = conf.AlignInts
+
 	return &table
 }
 
@@ -64,20 +67,23 @@ func (table *Table) WithHeaders(headers ...string) *Table {
 	table.Entries = [][]any{}
 	table.lenHeaders = make([]int, count)
 	table.Headers = make([]string, count)
+	table.RawHeaders = make([]string, count)
 
 	table.Addheaders(headers...)
 
 	return table
 }
 
-func (data *Table) Print() error {
+func (table *Table) Print() error {
-	switch data.Mode {
+	switch table.Mode {
 	case "json":
-		return data.PrintJSON()
+		return table.PrintJSON()
 	case "yaml":
-		return data.PrintYAML()
+		return table.PrintYAML()
+	case "csv":
+		return table.PrintCSV()
 	default:
-		return data.PrintTSV()
+		return table.PrintTSV()
 	}
 }
 
@@ -85,26 +91,12 @@ var (
 	ansiCtrlSeq = regexp.MustCompile(`\033.[0-9;]+m`)
 )
 
-// needed for json and yaml output
+func (table *Table) PrintYAML() error {
-func (data *Table) toMap() []map[string]any {
+	raw := table.toMap()
-	raw := make([]map[string]any, len(data.Entries))
-
-	for idx, entries := range data.Entries {
-		raw[idx] = make(map[string]any, len(data.Headers))
-		for eidx, entry := range entries {
-			raw[idx][data.Headers[eidx]] = entry
-		}
-	}
-
-	return raw
-}
-
-func (data *Table) PrintYAML() error {
-	raw := data.toMap()
 
 	body, err := yaml.Marshal(raw)
 	if err != nil {
-		return fmt.Errorf("failed to produce YAML output: %s", err)
+		return fmt.Errorf("failed to produce YAML output: %w", err)
 	}
 
 	fmt.Println(string(body))
@@ -112,12 +104,12 @@ func (data *Table) PrintYAML() error {
 	return nil
 }
 
-func (data *Table) PrintJSON() error {
+func (table *Table) PrintJSON() error {
-	raw := data.toMap()
+	raw := table.toMap()
 
 	body, err := json.MarshalIndent(raw, "", "  ")
 	if err != nil {
-		return fmt.Errorf("failed to produce JSON output: %s", err)
+		return fmt.Errorf("failed to produce JSON output: %w", err)
 	}
 
 	fmt.Println(string(body))
@@ -125,34 +117,35 @@ func (data *Table) PrintJSON() error {
 	return nil
 }
 
-func (data *Table) PrintTSV() error {
+func (table *Table) PrintTSV() error {
 	// length's, convert cell types
-	data.preprocessRows()
+	table.preprocessRows()
 
 	// output headers
-	for idx, header := range data.Headers {
+	for idx, header := range table.Headers {
-		if idx+1 != len(data.Headers) {
+		if idx+1 != len(table.Headers) {
-			fmt.Print(header, strings.Repeat(" ", data.lenHeaders[idx]-visibleLen(header)))
+			fmt.Print(header, strings.Repeat(" ", table.lenHeaders[idx]-visibleLen(header)))
 		} else {
 			// no padding for last header
 			fmt.Print(header)
 		}
 
-		if idx < len(data.Headers)-1 {
+		if idx < len(table.Headers)-1 {
 			fmt.Print("  ")
 		}
 	}
+
 	fmt.Println()
 
-	for _, entries := range data.rows {
+	for _, entries := range table.rows {
 		currentWidth := 0
 
 		for idx, entry := range entries {
 			length := visibleLen(entry)
 
-			if length+currentWidth > data.maxwidth && data.maxwidth-currentWidth > 1 {
+			if length+currentWidth > table.maxwidth && table.maxwidth-currentWidth > 1 {
 				// text is too wide to be put into one line, wrap it
-				wrapper := wordwrap.Wrapper(data.maxwidth-currentWidth, false)
+				wrapper := wordwrap.Wrapper(table.maxwidth-currentWidth, false)
 				wrapped := wrapper(entry)
 
 				// and indent it
@@ -165,55 +158,111 @@ func (data *Table) PrintTSV() error {
 				}
 			}
 
-			currentWidth += data.lenHeaders[idx]
+			currentWidth += table.lenHeaders[idx]
 
-			if isInt(entry) && data.alignInts {
+			switch {
+			case isInt(entry) && table.alignInts:
 				// align right
-				fmt.Print(strings.Repeat(" ", data.lenHeaders[idx]-length), entry)
+				fmt.Print(strings.Repeat(" ", table.lenHeaders[idx]-length), entry)
-			} else if length < data.lenHeaders[idx] && idx+1 != len(entries) {
+			case length < table.lenHeaders[idx] && idx+1 != len(entries):
 				// pad right, if required
-				fmt.Print(entry, strings.Repeat(" ", data.lenHeaders[idx]-length))
+				fmt.Print(entry, strings.Repeat(" ", table.lenHeaders[idx]-length))
-			} else {
+			default:
 				// no padding for last entry
 				fmt.Print(entry)
 			}
 
-			if idx < len(data.Headers)-1 {
+			if idx < len(table.Headers)-1 {
 				fmt.Print("  ")
 			}
 		}
+
 		fmt.Println()
 	}
 
 	return nil
 }
 
-func (data *Table) Sort() {
+func (table *Table) PrintCSV() error {
+	table.preprocessRows()
+
+	fmt.Println(strings.Join(table.RawHeaders, ","))
+
+	for _, entries := range table.rows {
+		row := make([]string, len(entries))
+
+		for idx, entry := range entries {
+			if strings.Contains(entry, " ") || strings.Contains(entry, ",") {
+				row[idx] = `"` + entry + `"`
+			} else {
+				row[idx] = entry
+			}
+		}
+
+		fmt.Println(strings.Join(row, ","))
+	}
+
+	return nil
+}
+
+func (table *Table) Sort() {
 	// sanity checks
-	if len(data.Entries) == 0 {
+	if len(table.Entries) == 0 {
 		return
 	}
 
-	data.preprocessRows()
+	table.preprocessRows()
 
-	sort.Slice(data.rows, func(i, j int) bool {
+	sort.Slice(table.rows, func(i, j int) bool {
-		return data.rows[i][0] < data.rows[j][0]
+		return table.rows[i][0] < table.rows[j][0]
 	})
 }
 
-func (data *Table) Addheaders(headers ...string) {
+func (table *Table) Addheaders(headers ...string) {
 	for idx, header := range headers {
-		switch data.Mode {
+		switch table.Mode {
 		case "json", "yaml":
-			data.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
+			table.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
 		default:
-			data.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
+			table.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
 		}
+
+		table.RawHeaders[idx] = header
 	}
 }
 
-func (data *Table) AddRow(fields ...any) {
+func (table *Table) AddRow(fields ...any) {
-	data.Entries = append(data.Entries, fields)
+	table.Entries = append(table.Entries, fields)
+}
+
+func (table *Table) AddRowLate(fields ...any) {
+	table.AddRow(fields)
+
+	if !table.processed {
+		return
+	}
+
+	row := make([]string, len(fields))
+
+	for idx, field := range fields {
+		row[idx] = any2string(field)
+	}
+
+	table.rows = append(table.rows, row)
+}
+
+// needed for json and yaml output
+func (table *Table) toMap() []map[string]any {
+	raw := make([]map[string]any, len(table.Entries))
+
+	for idx, entries := range table.Entries {
+		raw[idx] = make(map[string]any, len(table.Headers))
+		for eidx, entry := range entries {
+			raw[idx][table.Headers[eidx]] = entry
+		}
+	}
+
+	return raw
 }
 
 // return the length of a string but only visible chars, w/o ansi color escapes