Submit an issue View all issues Source
MIR-1226

`miren logs`: add absolute time-window filtering (`--since` / `--until`)

Done public
phinze phinze Opened Jun 5, 2026 Updated Jul 10, 2026

Today miren logs can only look backward from now. The only time control is --last <duration>, which sets start = now - duration and always pins end = now. There's no way to ask for a bounded historical window like "logs between 14:00 and 14:30 yesterday" — useful when you're chasing an incident with a known timeframe and don't want to scroll through everything since.

Proposal

Add a flag pair for absolute bounds, something like --since <timestamp> and --until <timestamp>, accepting RFC3339 (and ideally friendlier relative forms too). --since without --until reads up to now; --until without --since reads from the start of retention. These compose with the existing --grep/--service filters.

Why it's a small lift

The backend already does most of this. The streamLogChunks RPC (api/app/rpc.yml) takes a from timestamp, and the VictoriaLogs query layer (observability/logs.go) already calls executeQuery(..., start, end) with both bounds. The gaps are:

  • from is only ever wired to now - last, never an absolute time
  • there's no to/until parameter on the RPC, so end is hardcoded to time.Now() server-side
  • logReadOpts has a From field but no Until

So the work is roughly: add the CLI flags, add a to parameter to the RPC, add Until to logReadOpts, and thread it into the existing query call.

Applies to all log subcommands (app, sandbox, build, system).