add a --dump-query option for debugging

logcat.go

@@ -5,6 +5,7 @@
 package main
 
 import (
+	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -24,6 +25,7 @@ var (
 	fromDate       = flag.String("from", "", "start date (default 1 hour ago)")
 	toDate         = flag.String("to", "", "end date (default now)")
 	syslogFacility = flag.String("facility", "", "filter syslog_facility")
+	doDumpQuery    = flag.Bool("dump-query", false, "don't do anything, just print the ES query as JSON")
 )
 
 var allowedTimeFormats = []string{
@@ -75,7 +77,7 @@ func logstashIndexes(from, to time.Time) []string {
 	return idxs
 }
 
-func query(client *elastic.Client, q, facility string, from, to time.Time) error {
+func makeQuery(q, facility string, from, to time.Time) (elastic.Query, []string) {
 	queries := []elastic.Query{
 		elastic.NewTermQuery("type", "syslog"),
 		elastic.NewRangeQuery("@timestamp").From(from).To(to),
@@ -86,9 +88,16 @@ func query(client *elastic.Client, q, facility string, from, to time.Time) error
 	if facility != "" {
 		queries = append(queries, elastic.NewTermQuery("syslog_facility", facility))
 	}
-	query := elastic.NewBoolQuery().Must(queries...)
 
+	query := elastic.NewBoolQuery().Must(queries...)
 	indexes := logstashIndexes(from, to)
+	return query, indexes
+}
+
+func runQuery(client *elastic.Client, query elastic.Query, indexes []string) error {
+	if *doDumpQuery {
+	}
+
 	scroll := elastic.NewScrollService(client).
 		Index(indexes...).
 		Query(query).
@@ -116,11 +125,6 @@ func main() {
 	log.SetFlags(0)
 	flag.Parse()
 
-	client, err := elastic.NewClient(elastic.SetURL(*elasticURL))
-	if err != nil {
-		log.Fatal(err)
-	}
-
 	now := time.Now()
 	if *toDate == "" {
 		*toDate = now.Format(time.RFC3339)
@@ -141,8 +145,20 @@ func main() {
 		log.Fatal("--to comes before --from")
 	}
 
-	queryString := strings.Join(flag.Args(), " ")
-	if err := query(client, queryString, *syslogFacility, from, to); err != nil {
+	query, indexes := makeQuery(strings.Join(flag.Args(), " "), *syslogFacility, from, to)
+	if *doDumpQuery {
+		src, _ := query.Source()
+		b, _ := json.MarshalIndent(src, "", "    ")
+		log.Printf("indexes: %v", indexes)
+		log.Printf("query:\n%s", string(b))
+		return
+	}
+
+	client, err := elastic.NewClient(elastic.SetURL(*elasticURL))
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := runQuery(client, query, indexes); err != nil {
 		log.Fatal(err)
 	}
 }