# `logarchiver fetch`

Download, decrypt, and decompress archived objects to plain NDJSON.

```sh
logarchiver fetch [object-key ...] [flags]
```

Objects are selected either by explicit object-key arguments, or — when no keys
are given — by the same `--subject/--host/--from/--to` query used by
[`search`](search.md). When `--host/--from/--to` are supplied they ALSO
re-filter the emitted events to just the matching lines.

## Flags

| Flag | Meaning |
|---|---|
| `-o, --output` | `-` for stdout (default), or a directory to write one NDJSON file per object. |
| `--subject`/`--host`/`--from`/`--to`/`--limit` | Object selection (same as `search`) when no keys are given; host/time also re-filter emitted lines. |

## How decryption works

For each object, `fetch` reads the object header to learn which Vault GPG key
wrapped it, sends only the small wrapped data key to the engine's
`gpg/decrypt/<name>` endpoint, recovers the data key, and streams the AES-GCM
frames through local decryption + zstd to emit NDJSON. See the
[retrieval runbook](retrieval-runbook.md) for the full design and required creds
(S3 read, internal CA, ambient `VAULT_TOKEN`/`~/.vault-token`).

## Examples

```sh
# Straight to stdout by key:
logarchiver fetch archive/logs.k8s.vault._/2026/07/27/20260727T101500Z-ab12cd34.ndjson.zst.larc -o -

# From a query, re-filtered to host db-1 in the last 24h, into ./out:
logarchiver fetch --subject 'logs.vm.*' --host db-1 --from -24h -o ./out
```

Exit status is non-zero if any selected object fails; per-object errors are
reported on stderr and the remaining objects are still processed.