repost docs search prints a short cheatsheet; this page is the full reference.
Search indexed history
The text afterevents search / forwards search is a query over indexed fields. Scope with the --bucket / --forwarder flags — don’t put identifiers in the query (see Scope is enforced).
Fields for events search
A bare word with no
field: prefix searches the default fields only — path_original, request.body, response.body — not every field.
Operators
AND, OR, NOT, parentheses, and * / ? wildcards are supported:
path_original, so path:/stripe/* matches on path tokens, not the raw literal string.
Scope is enforced
The query is wrapped in mandatory organization and resource filters server-side:org_id:in a query is rejected withvalidation_failed.bucket_id:for a bucket you don’t own is rejected.forwarder_id:is stripped — use the--forwarderflag instead.
Filters for forwards search
Use flags for the common cases rather than query fields:
--failed is the correct way to find failures. A free-text status:FAILED is rewritten and will not match the delivery status field. Default bare-word search covers path_original, target_url, request.body, response.body, and error_message.Filter the live stream
expect and tail watch events as they arrive, before they’re indexed. They take a small, exact-match filter — not the search grammar above.
Wildcards in
--path use shell-glob matching (*, ?, […]) against the literal path — different from the tokenized wildcards of indexed search. Usage is covered in Wait for events.
Page with cursors
events search, forwards search, and the list commands paginate with --cursor. Read the cursor off each response and pass it back to get the next page.
- Forward-only. Each response carries
next_cursor; there is no backward cursor. Stop whenhas_moreisfalse. - Bound to the query and window. The cursor encodes a hash of the exact query plus
--since/--until. Change the query, bucket, forwarder, or window and the old cursor is rejected withvalidation_failed— “stale or invalid cursor; re-run the search.” - Replayable, not single-use. A cursor has no expiry or one-time semantics — re-sending it returns the same page. Treat it as “page N of this exact query,” not a token you can only spend once.
Continue
Diagnose a webhook
Put bounded search and the delivery chain to work on a real failure.
Wait for events
expect and tail against the live stream.Discovery
Pull the manifest and per-command schemas from the binary.