summaryrefslogtreecommitdiff
path: root/doc/examples.md
diff options
context:
space:
mode:
authorPaul Buetow <paul@buetow.org>2021-11-07 13:07:09 +0200
committerPaul Buetow <paul@buetow.org>2021-11-07 13:07:09 +0200
commit93e4ae02f1b1f8e03e72594e520f471fbac3c652 (patch)
tree3af5ddef1f0e3e267edfb859169234cef8f310d0 /doc/examples.md
parent7a59080a8b9555e1eb18024baf0627591509b006 (diff)
new dtail cont. map example gifs
Diffstat (limited to 'doc/examples.md')
-rw-r--r--doc/examples.md33
1 files changed, 22 insertions, 11 deletions
diff --git a/doc/examples.md b/doc/examples.md
index 6c23120..584a9fb 100644
--- a/doc/examples.md
+++ b/doc/examples.md
@@ -7,28 +7,30 @@ This page demonstrates the primary usage of DTail. Please also see ``dtail --hel
## Tailing logs
-The following example demonstrates how to follow logs of multiple servers at once. The server list is provided as a flat text file. The example filters all records containing the string ``STAT``. Any other Go compatible regular expression can be used instead of ``STAT``.
+The following example demonstrates how to follow logs of multiple servers at once. The server list is provided as a flat text file. The example filters all records containing the string ``INFO``. Any other Go compatible regular expression can be used instead of ``INFO``.
```shell
-% dtail --servers serverlist.txt --files "/var/log/service/*.log" --regex STAT
+% dtail --servers serverlist.txt --grep INFO --files "/var/log/dserver/*.log"
```
+Hint: you can also provide a comma separated server list, e.g.: `--servers server1.example.org,server2.example.org:PORT,...`.
+
![dtail](dtail.gif "Tail example")
-You can also use the shorthand version:
+You can also use the shorthand version (omitting the `--files`):
```shell
-% dtail --servers serverlist.txt --regex STAT "/var/log/service/*.log"
+% dtail --servers serverlist.txt --grep INFO "/var/log/dserver/*.log"
```
## Aggregating logs
-To run ad-hoc MapReduce aggregations on newly written log lines, you also must add a query. The following example follows all remote log lines and prints out every 5 seconds the top 10 servers with the most average free memory. To run a MapReduce query across log lines written in the past, please use the ``dmap`` command instead.
+To run ad-hoc MapReduce aggregations on newly written log lines, you also must add a query. The following example follows all remote log lines and prints out every few seconds the top 10 servers with the most average free memory. To run a MapReduce query across log lines written in the past, please use the ``dmap`` command instead.
```shell
-% dtail --servers serverlist.txt \
- --query 'select avg(memfree), $hostname from MCVMSTATS group by $hostname order by avg(memfree) limit 10 interval 5' \
- --files '/var/log/service/*.log'
+% dtail --servers serverlist.txt \
+ --files '/var/log/dserver/*.log' \
+ --query 'from STATS select sum($goroutines),sum($cgocalls),last($time),max(lifetimeConnections)'
```
For MapReduce queries to work, you have to ensure that DTail supports your log format. You can either use the ones already defined in ``internal/mapr/log format`` or add an extension to support a custom log format.
@@ -38,11 +40,20 @@ For MapReduce queries to work, you have to ensure that DTail supports your log f
You can also use the shorthand version:
```shell
-% dtail --servers serverlist.txt \
- 'select avg(memfree), $hostname from MCVMSTATS group by $hostname order by avg(memfree) limit 10 interval 5' \
- '/var/log/service/*.log'
+% dtail --servers serverlist.txt \
+ --files '/var/log/dserver/*.log' \
+ 'from STATS select sum($goroutines),sum($cgocalls),last($time),max(lifetimeConnections)'
+```
+Here is yet another example:
+
+```shell
+% dtail --servers serverlist.txt \
+ --files '/var/log/dserver/*.log' \
+ --query 'from STATS select $hostname,max($goroutines),max($cgocalls),$loadavg,lifetimeConnections group by $hostname order by max($cgocalls)'
```
+![dtail-map](dtail-map2.gif "Tail mapreduce example 2")
+
# How to use ``dcat``
The following example demonstrates how to cat files (display the full content of the files) of multiple servers at once. The servers are provided as a comma-separated list this time.