logalizer 0.1.0__py3-none-any.whl

logalizer/__init__.py

@@ -0,0 +1,8 @@
+"""logalizer — export Kibana logs as CSV via the Reporting API."""
+
+try:
+    from importlib.metadata import version as _version
+
+    __version__ = _version("logalizer")
+except Exception:  # pragma: no cover - fallback for uninstalled source tree
+    __version__ = "0.0.0"

logalizer/__main__.py

@@ -0,0 +1,4 @@
+from logalizer.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

logalizer/cli.py

@@ -0,0 +1,284 @@
+"""Command-line interface for logalizer."""
+import argparse
+import json
+import os
+import re
+import sys
+from datetime import datetime, timedelta, timezone
+
+from logalizer import reporting, indexpatterns
+from logalizer import init, ping
+from logalizer.client import Client, ClientError
+from logalizer.config import build_settings, config_file_path, load_config
+
+
+class UsageError(Exception):
+    pass
+
+
+_DURATION_RE = re.compile(r"^(\d+)([smhd])$")
+_UNIT_SECONDS = {"s": 1, "m": 60, "h": 3600, "d": 86400}
+
+
+def parse_duration(text):
+    m = _DURATION_RE.match(text)
+    if not m:
+        raise ValueError(f"invalid duration: {text!r} (expected like 15m, 1h, 24h, 7d)")
+    return timedelta(seconds=int(m.group(1)) * _UNIT_SECONDS[m.group(2)])
+
+
+def _iso(dt):
+    return dt.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
+
+
+def build_time_filter(from_iso, to_iso, last):
+    if from_iso and to_iso:
+        gte, lte = from_iso, to_iso
+    elif from_iso or to_iso:
+        raise UsageError("--from and --to must be used together")
+    else:
+        now = datetime.now(timezone.utc)
+        delta = parse_duration(last or "24h")
+        gte, lte = _iso(now - delta), _iso(now)
+    return {
+        "meta": {"field": "@timestamp", "params": {}},
+        "query": {"range": {"@timestamp": {
+            "format": "strict_date_optional_time",
+            "gte": gte, "lte": lte}}},
+    }
+
+
+HELP_TEXT = """\
+logalizer — export Kibana logs as CSV (Kibana 7.17 Reporting API)
+
+USAGE
+    logalizer [export] [OPTIONS]                 # export CSV (default action)
+    logalizer --list-spaces                      # print available spaces
+    logalizer --list-indices [--space SPACE]     # print index patterns
+    logalizer --list-fields --index PATTERN      # print fields (best-effort)
+    logalizer --help-json                        # machine-readable help
+    logalizer --init                             # write config.ini (wizard)
+    logalizer --init --url URL --username U --password P [--space S] [--index P] [--insecure]
+    logalizer --ping                             # test config + connectivity
+
+EXAMPLES (copy-paste ready)
+    # Last 24h of errors from brain service, clean columns
+    logalizer --index 'logs-*' --query 'level:error' --last 24h \\
+        --fields '@timestamp,level,msg,logger' -o brain-errors.csv
+
+    # Absolute time window, match a correlation id (your real query shape)
+    logalizer -i 'app-logs-*' \\
+        --query '"00000000-0000-0000-0000-000000000000"' \\
+        --from 2026-08-25T10:00:00Z --to 2026-08-25T14:00:00Z
+
+    # Everything from an index, all fields, streamed to stdout for piping
+    logalizer -i 'agent-logs-*' --last 1h | grep 'status:500'
+
+    # Discover what's available
+    logalizer --list-spaces
+    logalizer --list-indices --space default
+    logalizer --list-fields --index 'logs-*'
+
+QUERY OPTIONS
+    -q, --query KQL        KQL query (default: "" = match all)
+                           Examples: 'level:error'
+                                     'status:500 AND url:*api*'
+                                     'session_id:"01a03931-..."'
+    -i, --index PATTERN    index pattern (REQUIRED for export), e.g. 'logs-*'
+    -s, --space SPACE      Kibana space (default: from config, else default)
+    --last DURATION        relative range: 30s, 15m, 1h, 24h, 7d
+    --from ISO --to ISO    absolute range (ISO 8601). Overrides --last.
+                           Use both, or neither.
+    --fields LIST          comma-separated columns, in order.
+                           Omit to export ALL fields (wide, includes internals).
+
+OUTPUT OPTIONS
+    -o, --out PATH         write CSV to file (default: stdout)
+    --timeout SECONDS      max wait for the async job (default: 120)
+    --insecure             skip TLS cert verification (self-signed servers)
+    -v, --verbose          progress messages to stderr
+
+DISCOVERY OPTIONS (exit 0; print to stdout, one per line)
+    --list-spaces          list spaces
+    --list-indices         list index patterns in --space
+    --list-fields          list fields for --index (best-effort, may be partial)
+
+
+CONFIGURATION & DIAGNOSTICS
+    --init                write ~/.config/logalizer/config.ini (0600).
+                          Interactive wizard when url/username/password omitted;
+                          non-interactive when all three are given via flags.
+    --ping                health check: config -> TLS -> auth -> space -> index.
+                          Prints one line per check; exit 0 all good, else first
+                          failure (2 config, 3 auth, 5 network).
+    --url, --username, --password   used only by --init (never for export).
+
+CREDENTIALS (never pass on command line)
+    KIBANA_URL, KIBANA_USERNAME, KIBANA_PASSWORD   # env vars (recommended)
+    or ~/.config/logalizer/config.ini              # 0600 perms
+
+I/O CONTRACT
+    stdout = CSV data (or discovery output). stderr = all logs/errors.
+    Safe to run:  logalizer ... > out.csv   (diagnostics never pollute CSV)
+
+EXIT CODES
+    0  success
+    2  usage error (bad flags / missing required)
+    3  auth or permission failure (check KIBANA_USERNAME/PASSWORD, space)
+    4  job failed or timed out (see stderr for Kibana's error)
+    5  network / connection error
+
+GOTCHAS
+    - CSV export is capped by xpack.reporting.csv.maxSizeBytes (10 MB default).
+      Very large exports will fail the job; narrow --query or --last.
+    - Omitting --fields exports EVERY field (including _id, _index, _score,
+      _type, @version, agent.*). Usually you want an explicit --fields list.
+    - --list-fields may be incomplete for read-only roles; you can still pass
+      any field name directly.
+"""
+
+
+def help_json():
+    return {
+        "name": "logalizer",
+        "summary": "Export Kibana logs as CSV via the Kibana 7.17 Reporting API",
+        "flags": [
+            {"flag": "--query", "alias": "-q", "type": "string", "format": "KQL",
+             "default": "\"\"", "example": "level:error"},
+            {"flag": "--index", "alias": "-i", "type": "string", "format": "index-pattern",
+             "required": True, "example": "logs-*"},
+            {"flag": "--last", "type": "duration", "format": "30s|15m|1h|24h|7d",
+             "default": "24h", "example": "1h"},
+            {"flag": "--fields", "type": "csv-list", "default": "all fields",
+             "example": "@timestamp,level,msg"},
+            {"flag": "--out", "alias": "-o", "type": "path", "default": "stdout"},
+            {"flag": "--space", "alias": "-s", "type": "string", "default": "default"},
+            {"flag": "--init", "type": "bool", "default": "false"},
+            {"flag": "--ping", "type": "bool", "default": "false"},
+            {"flag": "--url", "type": "string", "used_by": "--init"},
+            {"flag": "--username", "type": "string", "used_by": "--init"},
+            {"flag": "--password", "type": "string", "used_by": "--init"},
+        ],
+        "exit_codes": {"0": "success", "2": "usage", "3": "auth/permission",
+                       "4": "job failed/timeout", "5": "network"},
+        "io_contract": {"stdout": "CSV data", "stderr": "diagnostics"},
+        "env": ["KIBANA_URL", "KIBANA_USERNAME", "KIBANA_PASSWORD"],
+    }
+
+
+def build_parser():
+    p = argparse.ArgumentParser(
+        prog="logalizer",
+        description="Export Kibana logs as CSV (Kibana 7.17 Reporting API)",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=HELP_TEXT,
+    )
+    p.add_argument("-q", "--query", default="", help="KQL query (default: match all)")
+    p.add_argument("-i", "--index", help="index pattern, e.g. 'logs-*'")
+    p.add_argument("-s", "--space", help="Kibana space (default: from config, else default)")
+    p.add_argument("--last", default="24h", help="relative range: 30s/15m/1h/24h/7d (default 24h)")
+    p.add_argument("--from", dest="from_iso", help="absolute range start (ISO 8601)")
+    p.add_argument("--to", dest="to_iso", help="absolute range end (ISO 8601)")
+    p.add_argument("--fields", help="comma-separated columns (omit = all fields)")
+    p.add_argument("-o", "--out", help="write CSV to file (default: stdout)")
+    p.add_argument("--timeout", type=int, help="max job wait in seconds (default 120)")
+    p.add_argument("--insecure", action="store_true", help="skip TLS verification")
+    p.add_argument("-v", "--verbose", action="store_true", help="progress to stderr")
+    p.add_argument("--list-spaces", action="store_true", help="list spaces")
+    p.add_argument("--list-indices", action="store_true", help="list index patterns")
+    p.add_argument("--list-fields", action="store_true", help="list fields for --index")
+    p.add_argument("--help-json", action="store_true", help="machine-readable help")
+    p.add_argument("--init", action="store_true", help="configure and write config.ini")
+    p.add_argument("--ping", action="store_true", help="test config + connectivity")
+    p.add_argument("--url", help="Kibana URL (for --init)")
+    p.add_argument("--username", help="username (for --init)")
+    p.add_argument("--password", help="password (for --init)")
+    return p
+
+
+def _err(msg, code):
+    print(f"logalizer: {msg}", file=sys.stderr)
+    return code
+
+
+def main(argv=None):
+    args = build_parser().parse_args(argv)
+
+    if args.help_json:
+        print(json.dumps(help_json(), indent=2))
+        return 0
+
+    try:
+        cfg = load_config()
+        settings = build_settings(
+            os.environ, cfg, space=args.space, index=args.index, fields=args.fields,
+            timeout=args.timeout, insecure=(True if args.insecure else None),
+        )
+
+        if args.init:
+            return init.run_init(args, os.environ, config_path=None)
+
+        if args.ping:
+            return ping.run_ping(settings, config_file_path())
+
+        if not settings.url or not settings.username or not settings.password:
+            return _err(
+                "missing credentials. Set KIBANA_URL/KIBANA_USERNAME/KIBANA_PASSWORD "
+                "or ~/.config/logalizer/config.ini. Exit code 2.", 2)
+
+        client = Client(settings.url, settings.username, settings.password,
+                        insecure=settings.insecure)
+
+        if args.list_spaces:
+            for s in indexpatterns.list_spaces(client):
+                print(s)
+            return 0
+        if args.list_indices:
+            for t in indexpatterns.list_index_patterns(client, settings.space):
+                print(t)
+            return 0
+        if args.list_fields:
+            if not settings.index:
+                return _err("--list-fields requires --index PATTERN", 2)
+            for f in indexpatterns.list_fields(client, settings.space, settings.index):
+                print(f)
+            return 0
+
+        # export
+        if not settings.index:
+            return _err("--index is required for export", 2)
+        index_id = indexpatterns.resolve_index_pattern(
+            client, settings.space, settings.index)
+        if not index_id:
+            return _err(
+                f"index pattern {settings.index!r} not found in space "
+                f"{settings.space!r}. Use --list-indices to see available patterns.", 2)
+
+        time_filter = build_time_filter(args.from_iso, args.to_iso, args.last)
+        columns = [c.strip() for c in settings.fields.split(",") if c.strip()] if settings.fields else None
+
+        if args.verbose:
+            print(f"submitting CSV job (index={settings.index}, space={settings.space})...",
+                  file=sys.stderr)
+        job_id = reporting.submit(client, settings.space, index_id,
+                                  args.query, time_filter, columns)
+        if args.verbose:
+            print(f"job {job_id} submitted, waiting...", file=sys.stderr)
+        reporting.poll(client, job_id, timeout=settings.timeout)
+        if args.verbose:
+            print("job completed, downloading...", file=sys.stderr)
+        csv_text = reporting.download(client, job_id)
+
+        if args.out:
+            with open(args.out, "w", encoding="utf-8") as fh:
+                fh.write(csv_text)
+        else:
+            sys.stdout.write(csv_text)
+        return 0
+
+    except ClientError as e:
+        return _err(str(e) + f" Exit code {e.exit_code}.", e.exit_code)
+    except UsageError as e:
+        return _err(str(e) + " Exit code 2.", 2)
+    except (ValueError, OSError) as e:
+        return _err(str(e) + " Exit code 2.", 2)

logalizer/client.py

@@ -0,0 +1,58 @@
+"""HTTP layer: basic auth + kbn-xsrf header, urllib-backed."""
+import base64
+import json
+import ssl
+import urllib.error
+import urllib.request
+
+
+class ClientError(Exception):
+    def __init__(self, message, exit_code):
+        super().__init__(message)
+        self.exit_code = exit_code
+
+
+def raise_for_status(status, body, what):
+    if status == 401:
+        raise ClientError("authentication failed (401). Check KIBANA_USERNAME/KIBANA_PASSWORD.", 3)
+    if status == 403:
+        raise ClientError("permission denied (403). Role lacks access to this space.", 3)
+    if status >= 400:
+        raise ClientError(f"{what} failed ({status}): {body}", 5)
+
+
+class Client:
+    def __init__(self, url, username, password, insecure=False, timeout=30):
+        self.base = (url or "").rstrip("/")
+        self.auth = "Basic " + base64.b64encode(
+            f"{username}:{password}".encode("utf-8")
+        ).decode("ascii")
+        self.insecure = insecure
+        self.timeout = timeout
+
+    def _context(self):
+        if self.insecure:
+            ctx = ssl.create_default_context()
+            ctx.check_hostname = False
+            ctx.verify_mode = ssl.CERT_NONE
+            return ctx
+        return None
+
+    def request(self, method, path, body=None):
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Authorization": self.auth}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(
+            self.base + path, data=data, method=method, headers=headers
+        )
+        req.headers["kbn-xsrf"] = "true"
+        try:
+            with urllib.request.urlopen(req, context=self._context(),
+                                        timeout=self.timeout) as resp:
+                raw = resp.read().decode("utf-8")
+                return resp.status, raw
+        except urllib.error.HTTPError as e:
+            return e.code, e.read().decode("utf-8")
+        except urllib.error.URLError as e:
+            raise ClientError(f"network error: {e.reason}", 5)

logalizer/config.py

@@ -0,0 +1,102 @@
+"""XDG path resolution and credential/settings assembly."""
+import configparser
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+
+def xdg_config_home() -> Path:
+    return Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"))
+
+
+def xdg_state_home() -> Path:
+    return Path(os.environ.get("XDG_STATE_HOME", Path.home() / ".local/state"))
+
+
+def xdg_cache_home() -> Path:
+    return Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache"))
+
+
+def config_file_path() -> Path:
+    return xdg_config_home() / "logalizer" / "config.ini"
+
+
+def load_config(path=None) -> dict:
+    """Return parsed config as a nested dict; {} if missing."""
+    p = Path(path) if path else config_file_path()
+    if not p.exists():
+        return {}
+    parser = configparser.ConfigParser()
+    parser.read(str(p))
+    return {section: dict(parser.items(section)) for section in parser.sections()}
+
+
+def write_config(sections, path=None):
+    """Write a nested {section: {key: value}} dict to config.ini, chmod 0600."""
+    p = Path(path) if path else config_file_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    parser = configparser.ConfigParser()
+    for section, items in sections.items():
+        clean = {str(k): str(v) for k, v in items.items()
+                 if v is not None and v != ""}
+        if clean:
+            parser[section] = clean
+    with open(p, "w", encoding="utf-8") as fh:
+        parser.write(fh)
+    os.chmod(p, 0o600)
+    return p
+
+
+def _as_bool(value, default=False) -> bool:
+    if value is None:
+        return default
+    return str(value).strip().lower() in ("1", "true", "yes", "on")
+
+
+@dataclass
+class Settings:
+    url: str = ""
+    username: str = ""
+    password: str = ""
+    space: str = "default"
+    index: str = None
+    fields: str = None
+    timeout: int = 120
+    insecure: bool = False
+
+
+def build_settings(env, cfg, space=None, index=None, fields=None,
+                   timeout=None, insecure=None) -> Settings:
+    """Resolve settings with precedence flag > env > config > default."""
+    kb = cfg.get("kibana", {})
+    df = cfg.get("defaults", {})
+
+    url = env.get("KIBANA_URL") or kb.get("url", "")
+    username = env.get("KIBANA_USERNAME") or kb.get("username", "")
+    password = env.get("KIBANA_PASSWORD") or kb.get("password", "")
+
+    resolved_space = space or env.get("KIBANA_SPACE") or df.get("space", "default")
+
+    resolved_timeout = timeout
+    if resolved_timeout is None and df.get("timeout"):
+        resolved_timeout = int(df["timeout"])
+    if resolved_timeout is None:
+        resolved_timeout = 120
+
+    if insecure is None:
+        env_val = env.get("KIBANA_INSECURE")
+        if env_val is not None:
+            insecure = _as_bool(env_val)
+        else:
+            insecure = _as_bool(kb.get("insecure"))
+
+    return Settings(
+        url=url,
+        username=username,
+        password=password,
+        space=resolved_space,
+        index=index if index else df.get("index"),
+        fields=fields if fields else df.get("fields"),
+        timeout=resolved_timeout,
+        insecure=insecure,
+    )

logalizer/indexpatterns.py

@@ -0,0 +1,57 @@
+"""Discovery helpers: spaces, index patterns, and pattern→data-view-ID resolution."""
+import json
+
+from logalizer.client import raise_for_status
+
+
+def list_spaces(client):
+    status, body = client.request("GET", "/api/spaces/space")
+    raise_for_status(status, body, "list spaces")
+    return [s["id"] for s in json.loads(body)]
+
+
+def list_index_patterns(client, space):
+    path = f"/s/{space}/api/saved_objects/_find?type=index-pattern&per_page=100"
+    status, body = client.request("GET", path)
+    raise_for_status(status, body, "list index patterns")
+    data = json.loads(body)
+    return [so["attributes"]["title"] for so in data.get("saved_objects", [])]
+
+
+def resolve_index_pattern(client, space, pattern):
+    """Return the data-view ID for a pattern title, or None."""
+    path = f"/s/{space}/api/saved_objects/_find?type=index-pattern&per_page=100"
+    status, body = client.request("GET", path)
+    raise_for_status(status, body, "resolve index pattern")
+    for so in json.loads(body).get("saved_objects", []):
+        if so["attributes"].get("title") == pattern:
+            return so["id"]
+    return None
+
+
+def list_fields(client, space, pattern):
+    """Best-effort field listing. Tries _fields_for_wildcard, then falls back
+    to the index-pattern's fieldAttrs. May return [] for read-only roles."""
+    path = (f"/s/{space}/api/index_patterns/_fields_for_wildcard"
+            f"?pattern={pattern}&meta_fields=_source")
+    status, body = client.request("GET", path)
+    if status == 200:
+        try:
+            fields = json.loads(body).get("fields", [])
+            if fields:
+                return [f["name"] for f in fields]
+        except (ValueError, KeyError):
+            pass
+
+    # fallback: index-pattern saved object fieldAttrs
+    path = f"/s/{space}/api/saved_objects/_find?type=index-pattern&per_page=100"
+    status, body = client.request("GET", path)
+    raise_for_status(status, body, "list fields")
+    for so in json.loads(body).get("saved_objects", []):
+        if so["attributes"].get("title") == pattern:
+            raw = so["attributes"].get("fieldAttrs", "{}")
+            try:
+                return sorted(json.loads(raw).keys())
+            except (ValueError, TypeError):
+                return []
+    return []

logalizer/init.py

@@ -0,0 +1,125 @@
+"""Interactive / non-interactive configuration writer."""
+import getpass
+import json
+import sys
+
+from logalizer import indexpatterns
+from logalizer.client import Client, ClientError
+from logalizer.config import _as_bool, load_config, write_config
+
+
+def _prompt(label, default):
+    suffix = f" [{default}]" if default else ""
+    val = input(f"{label}{suffix}: ").strip()
+    return val if val else default
+
+
+def _prompt_password(default):
+    suffix = " [set]" if default else ""
+    val = getpass.getpass(f"Password{suffix} (blank to keep): ")
+    return val if val else default
+
+
+def _connect(url, username, password, insecure):
+    """Return (client, message) on success, or (None, error) on failure."""
+    client = Client(url, username, password, insecure=insecure)
+    try:
+        status, body = client.request("GET", "/api/status")
+    except ClientError as e:
+        return None, f"connection failed: {e}"
+    version = "?"
+    if status == 200:
+        try:
+            version = json.loads(body)["version"]["number"]
+        except (ValueError, KeyError, TypeError):
+            pass
+    status, body = client.request("GET", "/internal/security/me")
+    if status in (401, 403):
+        return None, "authentication failed (wrong username/password?)"
+    if status != 200:
+        return None, f"auth endpoint returned HTTP {status}"
+    username_real = json.loads(body).get("username", "unknown")
+    return client, f"Kibana {version} as {username_real}"
+
+
+def _pick_numbered(items, title, default):
+    """Offer a numbered list; return selection, typed name, or default on blank.
+    If items is None (listing failed), fall back to free-text."""
+    if items:
+        print(f"{title}:")
+        for i, name in enumerate(items, 1):
+            print(f"  [{i}] {name}")
+        suffix = f" [{default}]" if default else ""
+        val = input(f"Pick a number, type a name, or Enter{suffix}: ").strip()
+        if val == "":
+            return default
+        if val.isdigit() and 1 <= int(val) <= len(items):
+            return items[int(val) - 1]
+        return val
+    return _prompt(title, default)
+
+
+def run_init(args, env, config_path=None):
+    existing = load_config(config_path)
+    kb = existing.get("kibana", {})
+    df = existing.get("defaults", {})
+
+    url = args.url or kb.get("url", "")
+    username = args.username or kb.get("username", "")
+    password = args.password or env.get("KIBANA_PASSWORD") or kb.get("password", "")
+    space = args.space or df.get("space", "default")
+    index = args.index or df.get("index", "")
+    insecure = args.insecure if args.insecure else _as_bool(kb.get("insecure"))
+
+    interactive = not (url and username and password)
+
+    if interactive:
+        print("Configuring logalizer (blank = keep existing)", file=sys.stderr)
+        url = _prompt("Kibana URL", url)
+        username = _prompt("Username", username)
+        password = _prompt_password(password)
+        ans = _prompt("Skip TLS verification? (y/N)", "y" if insecure else "")
+        insecure = ans.strip().lower() in ("y", "yes")
+
+        while True:
+            client, msg = _connect(url, username, password, insecure)
+            if client is not None:
+                print(f"  ✓ {msg}")
+                break
+            print(f"  ✗ {msg} — fix and retry")
+            url = _prompt("Kibana URL", url)
+            username = _prompt("Username", username)
+            password = _prompt_password(password)
+            ans = _prompt("Skip TLS verification? (y/N)", "y" if insecure else "")
+            insecure = ans.strip().lower() in ("y", "yes")
+
+        try:
+            spaces = indexpatterns.list_spaces(client)
+        except ClientError:
+            spaces = None
+        space = _pick_numbered(spaces, "Available spaces", space)
+
+        try:
+            indices = indexpatterns.list_index_patterns(client, space)
+        except ClientError:
+            indices = None
+        index = _pick_numbered(indices, f"Index patterns in '{space}'", index)
+
+    if not url or not username or not password:
+        print("logalizer: url, username and password are required.", file=sys.stderr)
+        return 2
+
+    merged = {section: dict(items) for section, items in existing.items()}
+    merged.setdefault("kibana", {}).update({
+        "url": url, "username": username, "password": password,
+        "insecure": "true" if insecure else "false",
+    })
+    merged.setdefault("defaults", {}).update({"space": space})
+    if index:
+        merged["defaults"]["index"] = index
+    else:
+        merged["defaults"].pop("index", None)
+
+    path = write_config(merged, path=config_path)
+    print(f"Wrote {path} (password: ***)")
+    return 0

logalizer/ping.py

@@ -0,0 +1,78 @@
+"""Config + connectivity health check."""
+import json
+
+from logalizer.client import Client, ClientError
+
+
+def _parse_version(body):
+    try:
+        return json.loads(body)["version"]["number"]
+    except (ValueError, KeyError, TypeError):
+        return "unknown"
+
+
+def run_ping(settings, config_path):
+    print("logalizer ping")
+
+    if config_path.exists():
+        print(f"  ✓ config: {config_path}")
+    else:
+        print(f"  - no config file (using env vars) — run `logalizer --init` to persist")
+
+    if settings.url and settings.username and settings.password:
+        print(f"  ✓ credentials present (user={settings.username}, password=***)")
+    else:
+        print("  ✗ missing credentials (url/username/password) — run `logalizer --init` "
+              "or set KIBANA_URL/KIBANA_USERNAME/KIBANA_PASSWORD")
+        return 2
+
+    client = Client(settings.url, settings.username, settings.password,
+                    insecure=settings.insecure)
+
+    try:
+        status, body = client.request("GET", "/api/status")
+    except ClientError as e:
+        print(f"  ✗ TLS/connectivity: {e}")
+        return 5
+    version = _parse_version(body) if status == 200 else "?"
+    print(f"  ✓ TLS + connectivity (Kibana {version})")
+
+    status, body = client.request("GET", "/internal/security/me")
+    if status in (401, 403):
+        print("  ✗ auth failed (401/403) — check KIBANA_USERNAME/KIBANA_PASSWORD")
+        return 3
+    if status != 200:
+        print(f"  ✗ auth endpoint returned HTTP {status}")
+        return 5
+    username = json.loads(body).get("username", "unknown")
+    roles = json.loads(body).get("roles", [])
+    print(f"  ✓ auth OK — logged in as {username} (roles: {', '.join(roles)})")
+
+    if not settings.space:
+        print("  - space check skipped (no space configured)")
+    else:
+        status, body = client.request("GET", "/api/spaces/space")
+        if status != 200:
+            print(f"  ✗ spaces list HTTP {status}")
+            return 5
+        spaces = [s["id"] for s in json.loads(body)]
+        if settings.space in spaces:
+            print(f"  ✓ space '{settings.space}' exists")
+        else:
+            avail = ", ".join(spaces) or "none"
+            print(f"  ✗ space '{settings.space}' not found (available: {avail})")
+            return 2
+
+    if not settings.index:
+        print("  - index check skipped (no index configured)")
+    else:
+        from logalizer.indexpatterns import resolve_index_pattern
+        index_id = resolve_index_pattern(client, settings.space or "default", settings.index)
+        if index_id:
+            print(f"  ✓ index '{settings.index}' resolves → data-view {index_id}")
+        else:
+            print(f"  ✗ index '{settings.index}' not found in space '{settings.space or 'default'}'")
+            return 2
+
+    print("All checks passed.")
+    return 0

logalizer/reporting.py

@@ -0,0 +1,60 @@
+"""Async CSV reporting job lifecycle: submit → poll → download."""
+import json
+import time
+
+from logalizer import rison
+from logalizer.client import ClientError, raise_for_status
+
+KIBANA_VERSION = "7.17.29"
+
+
+def submit(client, space, index_id, query, time_filter, columns):
+    search_source = {
+        "index": index_id,
+        "query": {"query": query, "language": "kuery"},
+    }
+    if time_filter is not None:
+        search_source["filter"] = [time_filter]
+    job_params = {
+        "title": "logalizer export",
+        "objectType": "search",
+        "browserTimezone": "UTC",
+        "version": KIBANA_VERSION,
+        "searchSource": search_source,
+    }
+    if columns:
+        job_params["columns"] = columns
+    body = {"jobParams": rison.encode(job_params)}
+    path = f"/s/{space}/api/reporting/generate/csv_searchsource"
+    status, raw = client.request("POST", path, body)
+    raise_for_status(status, raw, "submit CSV job")
+    return json.loads(raw)["job"]["id"]
+
+
+def poll(client, job_id, timeout=120):
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        status, raw = client.request(
+            "GET", "/api/reporting/jobs/list?page=0&size=100"
+        )
+        raise_for_status(status, raw, "poll job")
+        for job in json.loads(raw):
+            if job["id"] == job_id:
+                if job["status"] == "completed":
+                    return
+                if job["status"] == "failed":
+                    out = job.get("output") or {}
+                    detail = out.get("warnings") or out.get("error") or out
+                    raise ClientError(
+                        f"job {job_id} failed: {detail!r}. "
+                        "Try narrowing --query or --last.", 4)
+        time.sleep(2)
+    raise ClientError(f"job {job_id} did not complete within {timeout}s", 4)
+
+
+def download(client, job_id):
+    status, raw = client.request(
+        "GET", f"/api/reporting/jobs/download/{job_id}"
+    )
+    raise_for_status(status, raw, "download CSV")
+    return raw

logalizer/rison.py

@@ -0,0 +1,35 @@
+"""Minimal rison encoder (the wire format Kibana's reporting API expects).
+
+Rison: strings '...' (! -> !!, ' -> !'), null !n, true !t, false !f,
+array !(...), object (key:value,...). Keys matching an identifier are bare;
+all other keys are quoted.
+"""
+import re
+
+_ID_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_-]*$")
+
+
+def _escape(s):
+    return s.replace("!", "!!").replace("'", "!'")
+
+
+def encode(value):
+    if value is None:
+        return "!n"
+    if value is True:
+        return "!t"
+    if value is False:
+        return "!f"
+    if isinstance(value, str):
+        return "'" + _escape(value) + "'"
+    if isinstance(value, (int, float)):
+        return str(value)
+    if isinstance(value, dict):
+        parts = []
+        for k, v in value.items():
+            key = k if _ID_RE.match(k) else "'" + _escape(k) + "'"
+            parts.append(key + ":" + encode(v))
+        return "(" + ",".join(parts) + ")"
+    if isinstance(value, (list, tuple)):
+        return "!(" + ",".join(encode(v) for v in value) + ")"
+    raise TypeError(f"cannot rison-encode {type(value).__name__}")

logalizer-0.1.0.dist-info/METADATA

@@ -0,0 +1,85 @@
+Metadata-Version: 2.4
+Name: logalizer
+Version: 0.1.0
+Summary: Export Kibana logs as CSV from the command line via the Kibana Reporting API.
+Author: isdmx
+License: MIT
+Project-URL: Homepage, https://github.com/isdmx/logalizer
+Project-URL: Repository, https://github.com/isdmx/logalizer
+Keywords: kibana,elasticsearch,csv,logs,export,cli
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: System :: Logging
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# logalizer
+
+Export Kibana logs as CSV from the command line — via the Kibana 7.17
+Reporting API. No third-party dependencies (pure Python stdlib).
+
+`logalizer` authenticates to Kibana with basic auth, submits a CSV reporting
+job, polls until it completes, and writes the result to stdout or a file. It is
+built for both humans and scripts: clean exit codes and a strict stdout/stderr
+separation so `logalizer ... > out.csv` always yields only CSV on stdout.
+
+## Install
+
+    pip install logalizer
+
+Requires Python 3.10+.
+
+## Configure
+
+    logalizer --init
+
+Interactive wizard that validates your credentials and lets you pick a space and
+index pattern from live lists. Or set environment variables:
+
+    export KIBANA_URL=https://...
+    export KIBANA_USERNAME=...
+    export KIBANA_PASSWORD=...
+
+## Usage
+
+    # test connectivity and configuration
+    logalizer --ping
+
+    # discover what's available
+    logalizer --list-spaces
+    logalizer --list-indices --space <space>
+    logalizer --list-fields --index '<pattern>'
+
+    # export logs as CSV
+    logalizer -i '<index-pattern>' --query 'level:error' --last 24h \
+        --fields '@timestamp,level,msg' -o errors.csv
+
+Run `logalizer --help` for the full reference and `logalizer --help-json` for a
+machine-readable flag schema.
+
+## Release
+
+Publishing is automated via GitHub Actions Trusted Publishing.
+
+One-time setup on PyPI: project settings → Publishing → add a "pending
+publisher" with owner `isdmx`, repository `logalizer`, workflow `publish.yml`,
+environment `pypi`.
+
+To cut a release, either use the GitHub Actions UI (Actions → "Release" → "Run
+workflow", enter a version like 0.1.0) or from a local checkout:
+
+    git tag v0.1.0
+    git push --tags
+
+Either way, CI builds the sdist + wheel and uploads them to PyPI automatically.
+
+## License
+
+MIT

logalizer-0.1.0.dist-info/RECORD

@@ -0,0 +1,16 @@
+logalizer/__init__.py,sha256=M_m8V_l5YNOgfQvudDFxHF3Gr3t_o3V5Xqv9Z1rJwpw,274
+logalizer/__main__.py,sha256=RWhM-Y1tMFNj4jILR4IQEIu1w9GNkt-B0BoqHwcg2uk,88
+logalizer/cli.py,sha256=diVnJ28oxHwzW0EJ9BB9mW1MKvWKtdYOOx7hb5Li6ks,12401
+logalizer/client.py,sha256=zli8YTBqK6y7ua-FEphFzWQzrT1A9QpNW3g759-V9mc,2073
+logalizer/config.py,sha256=thLnhAQzjpouTrhlSokJw3XFKrrNrfHcHbGHJG2UdDc,3102
+logalizer/indexpatterns.py,sha256=6jObERRK8WizNHgve0W-xqKOlO0LR4uR5yDgvJSh7u4,2271
+logalizer/init.py,sha256=AcQgy_jW2CvhukpY1DW9fB4owUYSQDEgF3dkSiLuY0o,4676
+logalizer/ping.py,sha256=rcCAa2JV8CylPD006ygif6wGIUJVWbwKvT3e27-85CM,2879
+logalizer/reporting.py,sha256=0qToXB40DfLd1GPNRUR2Ztg3QLNKoEkfD0RYNBPRo0Y,2036
+logalizer/rison.py,sha256=poIgsThnBwRSEm591FB6BOipTEdcGs5Nq0n6TjXPlGI,1084
+logalizer-0.1.0.dist-info/licenses/LICENSE,sha256=xc4IY7C5WXvCeZlnKy2FUXMnZzkBPso8lbI8pi5FAOk,1062
+logalizer-0.1.0.dist-info/METADATA,sha256=Ot4We1NKbTK-bg0MWvKhmDclPzchFDbxMOckA6cVUoE,2661
+logalizer-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+logalizer-0.1.0.dist-info/entry_points.txt,sha256=R-_mtpglMTe7FNSoc3vapDAM54LNX49BUVP8ysI8bh0,49
+logalizer-0.1.0.dist-info/top_level.txt,sha256=3fEVfUDMmKdVV1y-n9xZyKLFNGyBof5omlzyR46p-Rk,10
+logalizer-0.1.0.dist-info/RECORD,,

logalizer-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

logalizer-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+logalizer = logalizer.cli:main

logalizer-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 isdmx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

logalizer-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+logalizer