obsidianlog query

Query archived logs by time range, service, level, host, or keyword.

This retrieves archived logs matching a set of filters. Results are decrypted index-first: a lightweight metadata index (under 1% of log size) is scanned first, so full chunks are only fetched and decrypted when they actually match.

Flags

Flag	Description
--from <TIME>	Inclusive lower bound of the time range. RFC 3339, or relative to now (e.g. 24h, 30m, 7d).
--to <TIME>	Inclusive upper bound of the time range. Same format as --from.
--service <NAME>	Filter by service name.
--level <LEVEL>	Filter by log level (e.g. info, warn, error).
--host <HOST>	Filter by originating host.
--keyword <TEXT>	Free-text keyword to match within log lines.
--format <FORMAT>	Output format: human (default, colorized terminal output), json (pretty-printed structured array), or raw (one decrypted JSON object per line, for piping to jq).

Plus the global --config <FILE>. All filters compose, and matching is exact per field.

Examples

# Last 24 hours of errors from the api service, human-readable.
obsidianlog query --service api --level error --from 24h --format human

# A specific window, piped to jq.
obsidianlog query --from 2026-08-01T00:00:00Z --to 2026-08-02T00:00:00Z \
  --format raw | jq '.msg'

# Free-text search across everything archived so far.
obsidianlog query --keyword "connection refused"