Howto search older messages

docs/logging.rst

@@ -49,6 +49,13 @@ In another terminal you can now use ``logcli`` to query ``loki`` like this:
 
 Please follow :ref:`logging:LogQL query examples` for more LogQL query examples.
 
+Search older messages (in this case the last week and limit the output to 2000
+lines):
+
+.. code:: bash
+
+    logcli query --since=168h --limit=2000 --forward '{app="helm-controller"}'
+
 LogQL query examples
 ~~~~~~~~~~~~~~~~~~~~
 
@@ -119,18 +126,6 @@ Filter out redundant ``helm-controller`` messages:
 
    '{app="helm-controller"} !~ `(unchanged|event=refreshed|method=Sync|component=checkpoint)`'
 
-Debug oauth2 single sign-on with zulip:
-
-.. code:: PromQL
-
-   {container_name=~"(hydra|zulip)"}
-
-Query kubernetes events processed by the ``eventrouter`` app containing
-``warning``:
-
-.. code:: PromQL
-
-   '{app="eventrouter"} |~ "warning"'
 
 Cert-manager
 ^^^^^^^^^^^^
@@ -155,6 +150,23 @@ Show only warnings and errors from ``hydra``:
 
    {container_name="hydra"} != "level=info"
 
+Debug oauth2 single sign-on with zulip:
+
+.. code:: PromQL
+
+   {container_name=~"(hydra|zulip)"}
+
+Etc
+^^^
+
+Query kubernetes events processed by the ``eventrouter`` app containing
+``warning``:
+
+.. code:: PromQL
+
+   '{app="eventrouter"} |~ "warning"'
+
+
 .. _kubectl logs: https://kubernetes.io/docs/concepts/cluster-administration/logging
 .. _Promtail: https://grafana.com/docs/loki/latest/clients/promtail/
 .. _Loki: https://grafana.com/oss/loki/