List the streams
The list shows each logs stream the user can read, with its number of fields, its retention, and
its description. --type lists the streams of another kind: metrics, traces, profiles, or
extend. --names prints only the names, and --json prints one stream per line as JSON.
Print the newest logs
The command prints the newest 100 logs of the last 15 minutes, oldest first, one per line: the
time, the level, the service, and the message.
The level is read from a field such as level, severity, or severity_text, the service from
service or service.name, and the message from message, msg, body, or log. A log
without a message field shows its other fields as name=value. Colours appear on a terminal;
NO_COLOR turns them off and FORCE_COLOR keeps them in a pipe.
Filter logs
-q takes a field query, the language of the Logs page: comparisons such as
level = 'error', contains, MATCH, and MATCH_TEXT, joined with AND and OR and grouped
with brackets. Text without a field is searched for in message:
--where takes an SQL condition on the stream’s fields, as in the WHERE clause of a query:
Given both, a log meets both. A condition that names a missing field, or that is not valid SQL,
ends the command with the reason.
Follow new logs
After the newest logs, the command keeps printing the ones that arrive until Ctrl+C:
- It reads again every 2 seconds;
--interval changes this.
- Each read starts 10 seconds before the end of the previous one, so that a log that reaches
MoleSignal a few seconds late still appears. Each log appears once.
- A burst larger than one read is read on at once, without waiting.
- A lost connection is retried with a growing pause of up to 30 seconds. The CLI reports the loss
and the return on standard error.
A follow tracks time in the logs themselves. A log that arrives with a time older than the start
of the current read does not appear. --to does not go with -f.
Read the logs around a moment
--around prints the logs just before and just after a moment, with a line at the moment
between them. -B and -A set how many, 10 each by default and 250 at most. -q and --where
narrow them:
A time copied from the output of molesignal logs is a moment --around takes.
Run SQL over a stream
molesignal query runs one read-only SQL statement, with expressions, joins, and aggregates, and
prints the result as a table:
The stream is the first one after FROM; --stream names another. The window is the last hour by
default; --since, --from, and --to change it. -n sets the most rows, 1000 by default and
5000 at most. --csv prints CSV with a head line, --json one row per line as JSON, and
--web opens the statement on the Logs page.
See the fields of a stream
The list shows each field with its type and its index. Given a field, the command lists its most
common values over the last hour, with their counts:
--match keeps the values that contain a text, and -n sets how many, 20 by default.
--type reads a stream of another kind.
Use the output in a pipe
--json prints each log with all its fields:
A reader that stops early, such as head, ends the command quietly.
Access
The CLI reads with MoleSignal’s tools list_streams, query_logs, get_stream_schema,
search_field_values, and search_around, with the permissions of the signed-in user or of the
owner of the API token. The user needs streams.query, and the organization’s Tool Policy must
not switch these tools off.Last modified on October 26, 2026
