# `logarchiver search`

Query the ClickHouse archive index for objects matching a subject/host/time
window. Prints one row per matching S3 object with event counts and sizes; use
the object keys with [`fetch`](fetch.md).

```sh
logarchiver search [flags]
```

## Flags

| Flag | Meaning |
|---|---|
| `--subject` | NATS-style subject glob: `*` matches one token, `>` matches the rest. e.g. `logs.vm.*`, `logs.k8s.vault.>`. |
| `--host` | Source host to match: exact, or a glob containing `*`. |
| `--from` | Start of window: RFC3339, `YYYY-MM-DD`, or a relative duration like `-24h`. |
| `--to` | End of window (same formats). |
| `--limit` | Max objects (default 100; `0` = no limit). |
| `--json` | Emit results as JSON instead of a table. |

An object matches the time window when its `[min_ts, max_ts]` overlaps
`[from, to]`. Objects are ordered by `min_ts`.

## Examples

```sh
# Vault audit logs from a node in the last day.
logarchiver search --subject 'logs.k8s.vault.>' --host node-1 --from -24h

# All VM logs for a host in July, as JSON.
logarchiver search --subject 'logs.vm.*' --host db-1 \
  --from 2026-07-01 --to 2026-08-01 --json
```

## Config

Uses `index.*` (ClickHouse address/database/table/credentials). Requires
`index.enabled: true`.