The Sondar CLI

sondar is the command-line client for a Sondar cluster — search, write data, manage resources, and run saved queries from a script or a terminal. Useful for automation, and for operations where the web UI is not the right surface.

Install

The CLI is the Python package sondar-cli (2.9.6, Python 3.10+), which installs a single sondar command.

pip install -e .        # from a source checkout of sondar-cli/

Today this needs the source checkout

pip install -e . is an editable install and only works if you have the sondar-cli/ directory. Publishing the package to an index — after which this becomes a plain pip install sondar-cli — is a separate step that has not happened yet, so do not expect the name to resolve from PyPI.

Not to be confused with bin/sondar-cli inside the server distribution, which is a different, Java program shipped in the image. The page you are reading documents the Python client you run on your own machine.

Connect to a cluster

Configuration lives in ~/.sondar/config.yaml. A password is never written there — only the token it generates.

# with an existing token
sondar config add -n prod -e http://localhost:9200 -t <token>

# with a username; you are prompted for the password and a token is created
sondar config add -n prod -e http://localhost:9200 -u myuser

sondar config list            # all configured clusters
sondar config use -n prod     # set the default
sondar config remove -n prod

Pass -c <name> to any command to override the default cluster for one call.

Which port -e wants. 9200 is the container’s own HTTP port and serves both the web UI and the API, so http://<host>:9200 is right for a plain docker run install — that is what the examples above assume. A deployment that puts a gateway or ingress in front of the container answers on whatever port that fronts instead (commonly 8080), and the CLI wants the address you open in a browser, not the container’s internal port. If a config add succeeds but every later command fails to reach the cluster, that mismatch is the first thing to check.

Search

sondar search 'repo=test01 | limit 10'
sondar search 'repo=test01 | limit 10' --format json
sondar search 'search2 repo="*" | stats count() as cnt by repo | sort by cnt | limit 10' -w --interval 1

--format accepts table, text, json, csv, html and latex. -w/--watch re-runs the query on an interval. See SonQL for the query language.

Write data

sondar insert --repo test01 '[{"a":1}]'
echo 'error: disk full' | sondar insert --repo test01

Manage resources

sondar asset covers 61 resource types — indexes, users, alerts, dashboards, and the rest — each exposing the verbs its API supports:

sondar asset                    # list the resource types
sondar asset repos list         # indexes
sondar asset repos create --name test_repo
sondar asset users list
sondar asset alerts create --help   # per-resource options

Saved queries and skills

sondar sonql list                 # the built-in SonQL queries
sondar sonql query slow-queries

sondar skills list              # agent skills that ship with the CLI
sondar skills get sondar-cli-troubleshoot
sondar skills install -a

Mock data

sondar mock --repo test01 --type log

Exit codes

0 on success, 1 on a runtime or authentication failure, 2 on a usage error — so scripts can tell “worked” from “failed” from “typed wrong”.