logquery-cli — search, tail, and analyze logs across Logtail, Grafana Loki, Datadog, and AWS CloudWatch from your terminal. CLI companion to LogLens MCP.

Providers

| Provider | Auth | Status | |---|---|---| | Logtail / Better Stack | LOGTAIL_TOKEN | ✓ | | Grafana Loki | LOKI_URL + optional LOKI_TOKEN | ✓ | | Datadog | DD_API_KEY + DD_APP_KEY | ✓ | | AWS CloudWatch | AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY + AWS_REGION | ✓ |

Installation

npm install -g logquery-cli

Or run directly:

npx logquery-cli --help

Quick Start

# Search recent errors in Datadog
logquery search --provider datadog --level error --limit 50

# Tail logs for a service in Loki
logquery tail --provider loki --service api --limit 100

# Grep for a pattern in CloudWatch
logquery grep --provider cloudwatch "NullPointerException" --service my-lambda

# Show log stats for Logtail
logquery stats --provider logtail --from 2024-01-01T00:00:00Z --to 2024-01-02T00:00:00Z

Commands

Free Commands

search

logquery search --provider <p> [--service <s>] [--level error|warn|info|debug]
                [--from <date>] [--to <date>] [--pattern <p>] [--limit <n>] [--json]

stats

logquery stats --provider <p> [--from <date>] [--to <date>] [--json]

errors

logquery errors --provider <p> [--from <date>] [--to <date>] [--limit <n>] [--json]

tail

logquery tail --provider <p> --service <s> [--level <l>] [--limit <n>] [--json]

grep

logquery grep --provider <p> <pattern> [--service <s>] [--from <date>] [--to <date>] [--json]

context

logquery context --provider <p> <log-id> [--lines <n>] [--json]

services

logquery services --provider <p> [--json]

Pro Commands

Requires PRO_LICENSE=CPK-<your-key>. Get a license at craftpipe.dev/products/logquery-cli.

anomalies

logquery anomalies --provider <p> [--from <date>] [--to <date>] [--service <s>] [--json]

Detects volume spikes, error spikes, new error types, and silence.

trace

logquery trace --provider <p> <trace-id> [--from <date>] [--to <date>] [--json]

Follow a distributed request trace across services.

diff

logquery diff --provider <p> --period-a <from>..<to> --period-b <from>..<to> [--json]

Compare error patterns and log volume between two time windows.

alerts

logquery alerts --provider <p> [--dry-run] [--from <date>] [--to <date>] [--json]

Show synthesized alert rules. Use --dry-run to preview which would trigger.

retention

logquery retention --provider <p> [--json]

Show retention settings and estimated monthly storage cost.

report

logquery report --provider <p> [--from <date>] [--to <date>] [--format json|markdown] [--output <file>] [--json]

Generate a full log analysis report.

Architecture

flowchart TD
    CLI[logquery CLI] --> Free[Free Commands\nsearch / stats / errors\ntail / grep / context / services]
    CLI --> Pro[Pro Commands\nanomalies / trace / diff\nalerts / retention / report]
    Pro --> Gate{PRO_LICENSE\nCPK-...}
    Gate -- valid --> Adapters
    Gate -- invalid --> Error[Error: requires Pro license]
    Free --> Adapters[Provider Adapters]
    Adapters --> LT[Logtail\nBearerToken]
    Adapters --> LK[Loki\nOptional Token]
    Adapters --> DD[Datadog\nAPI+App Key]
    Adapters --> CW[CloudWatch\nAWS SigV4]

Configuration

Set credentials as environment variables before running:

Logtail:

export LOGTAIL_TOKEN=your-token

Loki:

export LOKI_URL=http://loki:3100
export LOKI_TOKEN=optional-grafana-cloud-token

Datadog:

export DD_API_KEY=your-api-key
export DD_APP_KEY=your-app-key
export DD_SITE=datadoghq.com  # optional, default: datadoghq.com

CloudWatch:

export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=your-secret
export AWS_REGION=us-east-1

Pro license:

export PRO_LICENSE=CPK-your-license-key

JSON Output

All commands support --json for machine-readable output, making it easy to pipe into jq or other tools:

logquery errors --provider datadog --json | jq '.[0].pattern'
logquery stats --provider logtail --json | jq '.by_level'

License

MIT — Craftpipe