# Linux
curl -O -L "https://github.com/grafana/loki/releases/download/v2.9.0/logcli-linux-amd64.zip"
unzip logcli-linux-amd64.zip
sudo mv logcli-linux-amd64 /usr/local/bin/logcli
chmod +x /usr/local/bin/logcli

# macOS
brew install logcli

# 验证安装
logcli --version

# 使用 Docker
docker run --rm grafana/logcli:2.9.0 --version

# 设置别名
alias logcli='docker run --rm -ti grafana/logcli:2.9.0'

# 设置 Loki 地址
export LOKI_ADDR=http://localhost:3100

# 设置认证信息
export LOKI_USERNAME=admin
export LOKI_PASSWORD=admin

# 跳过证书验证
export LOKI_TLS_CA_CERT=/path/to/ca.crt

# 输出格式
export LOKI_OUTPUT_MODE=raw

# 查看默认配置路径
~/.config/logcli/config.yml

# 创建配置
cat > ~/.config/logcli/config.yml << EOF
address: http://localhost:3100
output-mode: raw
from: 24h
stats: false
EOF

# 查询最近 24 小时的日志
logcli query '{job="nginx"}'

# 指定时间范围
logcli query '{job="nginx"}' --from=2024-01-01T00:00:00Z --to=2024-01-02T00:00:00Z

# 相对时间查询
logcli query '{job="nginx"}' --from=1h
logcli query '{job="nginx"}' --from=30m
logcli query '{job="nginx"}' --from=7d

# 限制返回条数
logcli query '{job="nginx"}' --limit=100

# 包含关键字
logcli query '{job="nginx"}' |= "error"

# 排除关键字
logcli query '{job="nginx"}' != "debug"

# 正则匹配
logcli query '{job="nginx"}' |~ "error.*timeout"

# 否定正则
logcli query '{job="nginx"}' |~! "info.*debug"

# 多个过滤条件
logcli query '{job="nginx"}' |= "error" |~ "timeout|connection"

# 统计错误数量
logcli query '{job="nginx"}' | json | stats
logcli query '{job="nginx"}' | json | line_format "{{.status}}"

# 按标签聚合
logcli query '{job="nginx"}' | json | sum by (status) (rate(counter[5m]))

# 统计日志条数
logcli query '{job="nginx"}' --stats

# 原始输出
logcli query '{job="nginx"}' --output=raw

# 标准输出
logcli query '{job="nginx"}' --output=default

# JSON 输出
logcli query '{job="nginx"}' --output=jsonl

# 美化 JSON
logcli query '{job="nginx"}' --output=json

# raw 格式
2024-01-15T10:00:00Z job=nginx msg="GET /api/health status=200 duration=5ms"

# json 格式
{
  "streams": [...],
  "status": "success",
  "stats": {...}
}

# 显示查询统计
logcli query '{job="nginx"}' --stats

# 输出示例
Ingester head chunk bytes: 2.1k
Ingester head chunk entries: 42
Ingester decomposed path missed regexp: 0
Total bytes matched: 15.2k
Total lines matched: 128
Total streams matched: 3

# 并行客户端数
logcli query '{job="nginx"}' --parallelize=4

# 统计信息包含
logcli query '{job="nginx"}' --include-stats

# 设置时区
logcli query '{job="nginx"}' --timezone=Asia/Shanghai

# 时间格式化
logcli query '{job="nginx"}' --time-format=2006-01-02\ 15:04:05

# 实时跟踪日志
logcli query '{job="nginx"}' --tail

# 带过滤的实时跟踪
logcli query '{job="nginx"}' |= "error" --tail

# 带超时的实时跟踪
logcli query '{job="nginx"}' --tail --from=1h --timeout=5m

# 查看标签名称
logcli labels

# 查看标签值
logcli label job values

# 查看所有标签值
logcli labels '{job="nginx"}'

# 查看所有 series
logcli series '{job="nginx"}'

# 查看带过滤的 series
logcli series '{job=~".*"}'

# 查看特定时间范围的 series
logcli series --from=1h --to=now '{job="nginx"}'

# 导出到文件
logcli query '{job="nginx"}' --from=1d > nginx.logs

# 导出到 gzip
logcli query '{job="nginx"}' --from=1d | gzip > nginx.logs.gz

# 导出带统计信息
logcli query '{job="nginx"}' --from=1d --stats > nginx.stats.json

# 1. 基本查询
logcli query '{job="nginx"}' --from=24h

# 2. 错误日志查询
logcli query '{job="nginx"}' |= "error" --from=1h

# 3. 实时跟踪
logcli query '{job="nginx"}' --tail

# 4. 按服务统计
logcli query '{job=~".*"}' | json | stats

# 5. 导出日志
logcli query '{job="nginx"}' --from=7d --output=jsonl > nginx.jsonl

# 6. 查看 series
logcli series '{job="api-server"}'