[blue4209211]

Nubi copies the logs query --help examples first. Both Elasticsearch examples used {"match": ...}. On a field mapped as keyword (log on dev account bda8ae12), match compares the whole value and silently returns 0. Nubi then spent dozens of calls finding out why: 49+ calls locally on v0.0.4, and 80+ on dev with the old nbctl.

Changes

• Both Elasticsearch examples use {"wildcard":{"log":{"value":"*error*","case_insensitive":true}}}, which works on keyword and text fields alike.
• One added help paragraph: check a field's Type (nbctl logs list-labels --fields-only) before searching it, because match on a keyword field compares the whole value.

Help text only; no behavior change.

Testing

• make build passes (lint, go test -race ./..., build).
• Live on dev, Elasticsearch account bda8ae12, 6h window:
  • both old examples return 0 lines;
  • the new lines example returns lines (total ≥ 10,000);
  • the new counts example returns 265 series summing to 170,084, exactly the reported total;
  • list-labels --fields-only shows log as keyword.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the help text and example commands in cmd/logs_query.go for Elasticsearch queries. It adds a note explaining that matching on a keyword field compares the whole value, and updates the examples to use case-insensitive wildcard queries instead of match queries on the log field. There are no review comments, so we have no feedback to provide.