The Sondar CLI

sondar is the command-line client for a Sondar cluster — search, write data, manage resources, and run saved queries from a script or a terminal. Useful for automation, and for operations where the web UI is not the right surface.

Install

pip install -e .

This installs the sondar command from the sondar-cli distribution.

Connect to a cluster

Configuration lives in ~/.sondar/config.yaml. A password is never written there — only the token it generates.

# with an existing token
sondar config add -n prod -e http://localhost:9200 -t <token>

# with a username; you are prompted for the password and a token is created
sondar config add -n prod -e http://localhost:9200 -u myuser

sondar config list            # all configured clusters
sondar config use -n prod     # set the default
sondar config remove -n prod

Pass -c <name> to any command to override the default cluster for one call.

Search

sondar search 'repo=test01 | limit 10'
sondar search 'repo=test01 | limit 10' --format json
sondar search 'search2 repo="*" | stats count() as cnt by repo | sort by cnt | limit 10' -w --interval 1

--format accepts table, text, json, csv, html and latex. -w/--watch re-runs the query on an interval. See SonQL for the query language.

Write data

sondar insert --repo test01 '[{"a":1}]'
echo 'error: disk full' | sondar insert --repo test01

Manage resources

sondar asset covers 61 resource types — indexes, users, alerts, dashboards, and the rest — each exposing the verbs its API supports:

sondar asset                    # list the resource types
sondar asset repos list         # indexes
sondar asset repos create --name test_repo
sondar asset users list
sondar asset alerts create --help   # per-resource options

Saved queries and skills

sondar sonql list                 # the built-in SonQL queries
sondar sonql query slow-queries

sondar skills list              # agent skills that ship with the CLI
sondar skills get sondar-cli-troubleshoot
sondar skills install -a

Mock data

sondar mock --repo test01 --type log

Exit codes

0 on success, 1 on a runtime or authentication failure, 2 on a usage error — so scripts can tell “worked” from “failed” from “typed wrong”.