kql-panopticon 0.2.0

Terminal UI for executing KQL queries across multiple Azure Log Analytics workspaces concurrently with CSV/JSON export
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use clap::{Parser, Subcommand, ValueEnum};

#[derive(Parser)]
#[command(name = "kql-panopticon")]
#[command(version, about = "Execute KQL queries across Azure Log Analytics workspaces")]
pub struct Cli {
    #[command(subcommand)]
    pub command: Option<Commands>,
}

#[derive(Subcommand)]
pub enum Commands {
    /// Launch interactive TUI (default)
    Tui,

    /// Run a query pack
    RunPack {
        /// Path to query pack file (.yaml, .yml, or .json)
        /// Can be absolute path or relative to ~/.kql-panopticon/packs/
        pack: String,

        /// Override workspace selection (comma-separated IDs or 'all')
        #[arg(short, long)]
        workspaces: Option<String>,

        /// Output format
        #[arg(short = 'f', long, value_enum, default_value = "files")]
        format: OutputFormat,

        /// Print results to stdout as JSON (alias for --format stdout)
        #[arg(long)]
        json: bool,

        /// Validate pack without executing
        #[arg(long)]
        validate_only: bool,
    },

    /// Export a session as a query pack
    ExportPack {
        /// Session name to export
        session: String,

        /// Output path (default: ~/.kql-panopticon/packs/<session-name>.yaml)
        #[arg(short, long)]
        output: Option<std::path::PathBuf>,

        /// Output format
        #[arg(short = 'f', long, value_enum, default_value = "yaml")]
        format: PackFormat,
    },
}

#[derive(ValueEnum, Clone)]
pub enum OutputFormat {
    /// Write to files (default)
    Files,
    /// Print to stdout as JSON
    Stdout,
}

#[derive(ValueEnum, Clone)]
pub enum PackFormat {
    /// YAML format (default)
    Yaml,
    /// JSON format
    Json,
}