NAME

       tlog-play - play back terminal I/O recorded by tlog-rec(8)

SYNOPSIS

       tlog-play [OPTION...]

DESCRIPTION

       Tlog-play is a playback program for terminal I/O recorded with tlog-rec(8).  It reproduces
       the recording on the terminal it's run under, and can't change its size, so  the  playback
       terminal size needs to match the recorded terminal size for proper playback.

       Tlog-play  loads  its  parameters  from the system-wide configuration file /etc/tlog/tlog-
       play.conf, which can be overridden with command-line options described below.

OPTIONS

   General options
       -h, --help
              Output a command-line usage message and exit.

       -v, --version
              Output version information and exit.

       --configuration
              Output program configuration in JSON and exit.

       -s, --speed=NUMBER
              Set playback speed multiplier to NUMBER.

              NUMBER is a floating-point number to multiply playback speed by.  Can  be  adjusted
              during playback.

              Value minimum: 0

       -f, --follow
              Wait for and play back new messages.

              If  specified,  when  the  end  of  the  recorded  session is reached, wait for new
              messages to be added and play them back when they appear.

       -g, --goto=STRING
              Fast-forward to STRING time (start/end/HH:MM:SS.sss).

              STRING is a logical location,  or  a  time  to  which  recording  should  be  fast-
              forwarded.   Can  be  a  "start",  or  an "end" string, or a timestamp formatted as
              HH:MM:SS.sss, where any part can be omitted to mean zero.

       -p, --paused
              Start playback paused.

              If specified, playback is started in a paused state.

       -r, --reader=STRING
              Use STRING log reader (file/journal/es, default file).

              STRING is the type of "log reader" to use for retrieving log messages.  The  chosen
              reader needs to be configured using its own dedicated parameters.

              Value should be one of: "file", "journal", "es"

       --persist
              Ignore quit key and signals from keyboard.

              If specified, ignore any keyboard-generated signals and the quit key.

       --lax  Ignore missing (dropped) log messages.

              If  specified, ignore missing (dropped, or lost) log messages.  Otherwise report an
              error and abort when a message is missing.

   File reader options
       -i, --file-path=FILE
              Read log from FILE file.

              FILE is the path to the file the "file" reader should read logs from.

       -m, --file-match=STRING
              Playback explicit recording id specified in STRING.

              STRING is the recording id of the recording the "file" reader should  seek  to  for
              playback.

   Elasticsearch reader options
       --es-baseurl=STRING
              Elasticsearch URL without query or fragment parts.

              STRING  is  the base URL to request Elasticsearch through. Should not contain query
              (?...) or fragment (#...) parts.

       --es-query=STRING
              Elasticsearch query.

              STRING is the query string to send to Elasticsearch

       --es-verbose
              Enable verbose output on Elasticsearch HTTP client.

              If specified, enable verbose output on Elasticsearch HTTP client.

   Systemd journal reader options
       -S, --journal-since=SECONDS
              Start searching journal at SECONDS since epoch.

              SECONDS is the number of seconds since epoch to seek to before  searching  for  the
              first matching log entry.

              Value minimum: 0

       -U, --journal-until=SECONDS
              Stop searching journal at SECONDS since epoch.

              SECONDS  is  the  number  of seconds since epoch at which searching for log entries
              should stop.

              Value minimum: 0

       -M, --journal-match=STRING
              Add STRING to journal match symbol list.

              Each STRING specifies a journal match symbol: either a name-value  pair,  according
              to  sd_journal_add_match(3),  or  an "OR" or "AND" string signifying disjunction or
              conjunction,        as        with        sd_journal_add_disjunction(3)         and
              sd_journal_add_conjunction(3)

       -N, --journal-namespace=STRING
              Search for the records in STRING namespace only.

              STRING is the Specifies a specific journal namespace to use.

CONTROLS

       Playback can be controlled using the following keys:

       SPACE, p
              Pause/resume playback.

       }      Double the playback speed. Maximum is 16x.

       {      Halve the playback speed. Minimum is 1/16x.

       BACKSPACE
              Reset playback to normal, 1x speed.

       .      Output  the  next  packet  immediately, without delay, regardless if paused or not.
              Press when paused to step through recording. Press once to skip a long pause.  Hold
              to skip through recording at constant speed (the keyboard repeat rate).

       G      Fast-forward  the  recording  to the end, or to specified time. Works while playing
              and on pause. The time can be specified by typing in a  timestamp  before  pressing
              'G'.  The  timestamp  should  follow  the format of the -g/--goto option value, but
              without the fractions of a second. The command has no effect, if the specified time
              location has already been reached.

              E.g.  pressing  just  'G'  would  fast-forward  to  the  end,  which is useful with
              following enabled. Pressing '3', '0', 'G' (typing "30G") would fast-forward  to  30
              seconds  from  the start of the recording. Typing "30:00G" would fast-forward to 30
              minutes, and so would "30:G", and "1800G". Typing "2::G" would fast-forward to  two
              hours into the recording, the same as "120:G" and "7200G".

       q      Stop playing and quit.

FILES

       /etc/tlog/tlog-play.conf
              The system-wide configuration file

BUGS

       Recordings  can include control sequences attempting to communicate with the terminal, and
       the playback terminal would dutifully reply to them.   Tlog-play  tries  to  filter  these
       responses  out,  but  since  it's not a full terminal emulator itself, and since there's a
       great variety of such control sequences, it can sometimes  fail,  and  interpret  some  of
       these as playback control keys described above, with corresponding effects.

       This  is  going  to  be  fixed in future releases, possibly by embedding a proper terminal
       emulator in tlog-play. For now, most recordings would reproduce correctly, but some  might
       exhibit  erratic  behavior,  and  it is possible to e.g. make a recording which would skip
       (hide) a part of itself on playback. However, there are other, easier ways to hide actions
       on a terminal, of course.

EXAMPLES

       Play back contents of a file written with tlog-rec's "file" writer:
              tlog-play -r file --file-path=recording.log

       Play back a recording from Journal:
              tlog-play -r journal -M TLOG_REC=6071524bb44d403991a00413ab7c8596-53bd-378c5d9

       Play back a recording from Elasticsearch:
              tlog-play    -r   es   --es-baseurl=http://localhost:9200/tlog/tlog/_search   --es-
              query=session:121

SEE ALSO

       tlog-play.conf(5), tlog-rec(8)

AUTHOR

       Nikolai Kondrashov <spbnick@gmail.com>