estail

#!/usr/bin/ruby

require 'json'
require 'term/ansicolor'
require 'optparse'
require 'httparty'
require 'set'

include Term::ANSIColor

@today = Time.now.strftime "%Y.%m.%d"
@seen = Set.new

def get_logs(options={})
  host = options[:host] || 'localhost:9200'
  size = options[:lines] || 100
  date = options[:date] || @today
  follow = options[:follow] || false

  query = {:size => size, :sort => [{"@timestamp" => {:order => 'desc'}}]}
  execute(host, date, query)

  while true do 
    get_new host, date
    sleep 0.25
  end if follow
end

def get_new(host, date)
  query = {
    :query => {:filtered => {:filter => {
      :range => {"@timestamp" => {:from => 'now-1m', :to => 'now'}}
      }}},
    :sort => [{"@timestamp" => {:order => 'desc'}}]
  }
  
  execute(host, date, query)
end

def execute(host, date, query)
  result = HTTParty.post("http://#{host}/logstash-#{date}/_search", :body => query.to_json)
  json = JSON.parse result.body

  json['hits']['hits'].reverse_each do |hit|
    next if(@seen.include? hit['_id'])
    @seen.add hit['_id']
    source = hit['_source']
    puts "#{yellow}#{source['@timestamp']} #{source['app']}/#{source['container']} #{source['type']}:#{reset} #{source['message']}"
  end
end

options = {}
OptionParser.new do |opts|
  opts.banner = <<-STR
Usage: #{__FILE__} [options]
  STR
  
  opts.separator "\nOptional arguments:"

  opts.on '-h', '--host [HOST:PORT]', 'The Elastic Search host to connect to (default: localhost:9200)' do |param| 
    options[:host] = param
  end
  opts.on '-f', '--follow', 'Stream the logs (like tail -f)' do |param| 
    options[:follow] = param
  end
  opts.on '-n', '--lines N', 'The number of lines to display' do |param| 
    options[:lines] = param
  end
  opts.on '-d', '--date [DATE]', "The date to view from (e.g. #{@today})" do |param| 
    options[:date] = param
  end

  opts.on_tail '--help', "Show this message" do
    puts opts
    exit
  end

end.parse!(ARGV)

get_logs(options)