## zowe › ejes › log › stream

Outputs the operations log or system log to stdout. Behaves like a Linux tail function with support for standard tail options --follow (-f), --lines (-n), -q, -v, and --version.

      Set the position in the log to begin output using \-\-find, \-\-line, \-\-time, and \-\-offset.

      Use OPERLOG Message Filtering Options to create a windowed log by filtering for and outputting only lines that fit criteria, e.g., fetch only lines associated with an IAT6xxxx message by specifying: \-\-msgId "IAT6\*".  After filtering the log, output is positioned at the bottom.  Use position options to change that.

      Turn on highlighting for \-\-find using \-\-hilite.  Perform regex text matching with highlighting using \-\-match.  Enable MCS console color emulation with \-\-mcs.  To prevent ANSI escape characters from being output and to instead use accessibility\-friendly text\-only indicators, specify: \-\-nocolor "on".

      The order of host commands issued during initialization are fixed in this program in this order:

1. All OPERLOG message filtering options, e.g., --msgId and --msgTxt

2. --line

3. --time

4. --find

5. --offset

   Conceptually and depending on specified options, the program can create a window into the log data using message filtering options, then can point to a line in the data such as the first line, then can position at a time, then find arbitrary text, then offset the view up and down by seconds to days or a number of lines.

   The program outputs trailer diagnostic lines at the end of the run to stderr. Use this information to make your queries more efficient. The trailer and header lines can be muted using the --quiet (-q) option or setting the EJES_LOG_CLI_QUIET environment variable. The program outputs a bottom-of-data line to stdout that is considered an output line by --lines with a line-count argument. To disable it, set the EJES_LOG_CLI_NO_BOTTOM environment variable.

#### Usage

zowe ejes log stream [log-type] [options]

#### Positional Arguments

- `log-type` (string)

  - Optional. If not specified, the Operations Log is output if the Operations Log is active for the current MVS system. Otherwise, the System Log is output. Must match regular expression: `operlog|oper|o|syslog|sys|s`

#### Options

- `--follow` | `-f` | `--nonstop` | `--ns` (boolean)

  - Follow the log stream. Displays last page of log then waits for more data. Ignored for --response-format-json. The actual maximum duration is controlled by your host refresh command settings.

- `--lines` | `-n` (array)

  - Limit output to a number of lines or a time span. 10 lines is used if the option is not specified.

          Specify a maximum number of lines up to 999,999 lines (supports multipliers), or specify a time span of 0.01 to 999 seconds, minutes, hours, or days by specifying a number followed by "s", "m", "h", or "d".  Specify  "all" for unlimited output.

          When \-\-request\-format\-json (\-\-rfj) is specified, the number of lines up to 5,000 specified on this option (or the default of 10) determines the number of lines fetched from the host and stored in the output json data array.  With \-\-rfj, this option overrides \-\-enumValue.

          Supports Linux positioning syntax of \+ followed by a line number.  This is the same as specifying \-\-line n \-\-lines all.  When the intent is to fetch middle lines from the log, use \-\-line to position and \-\-lines to limit the count.

          Note: When there are no positioning requests, the program attempts to get the bottom n lines.  However, the log is a dynamic data set and the actual log type may be different than assumed.  The bottom\-of\-data line will output only if the number of lines is not exceeded when bottom is found.

    Allowed values: all, ^(?:[1-9]|\d\.)\d{0,2}[smhd]$, ^[1-9]\d{0,5}$, ^\+[1-9]\d*$, ^[1-9]\d{0,2}(b|kB|K|MB|M|GB|G|KiB|MiB|GiB)$

- `--bytes` | `-c` (string)

  - Byte level output counts supported only for syntax checking. Use --lines or filter with a TAIL terminal command instead.

    Allowed values: ^\+[1-9]\d*$

- `--quiet` | `-q` | `--silent` (boolean)

  - Do not display header or trailer lines. Set the environment variable EJES_LOG_CLI_QUIET to make this the default. Set EJES_LOG_CLI_NO_BOTTOM to prevent displaying the bottom of data line.

- `--verbose` | `-v` (boolean)

  - Display header lines or trailer. This is the default unless the environment variable EJES_LOG_CLI_QUIET is set. Set EJES_LOG_CLI_NO_BOTTOM to prevent displaying the bottom of data line.

- `--version` (boolean)

  - Display version header and quit.

- `--requests` (number)

  - Limit the number of normally unlimited host requests. Only host requests for data, additional data, or find next data count as a request.

#### ANSI Color Options

- `--mcs` | `--mcsConsoleColor` | `--mcs-console-color` (boolean)

  - Use ANSI escape characters to emulate the color and extended highlighting attributes in OPERLOG output to resemble the formatting on an MCS operator console. If --no-color on is specified, textual attributes will be prefixed instead. The MVS "DISPLAY MPF" command displays the message assignments color attributes in use on your host system.

- `--match` | `--matchText` | `--match-text` | `--mt` | `-m` (string)

  - Specify case-independent text to match and highlight using ANSI escape characters.

          Specify a string, a Javascript regex pattern without the enclosing slashes (e.g., "login|logoff|force"), or a Javascript regex pattern string with slashes and regex option flags (e.g., "/\[Ll\]ogo.{1,2}|Signoff/g").  If the first or second type is used, the flags default to ig (ignore\-case and global match).

          Matching does not position for output the way \-\-find does; it can be used in conjuction with a \-\-find.  Matching is done on each output line separately.  All matches in a line will be highlighted.  If \-\-no\-color on is specified, the line will be prefixed with ">".  If the built\-in highlight attribute isn't visible on your terminal, either change the foreground color or set the environment variable EJES\_LOG\_CLI\_ANSIMATCHATTR.  0 to 256 are valid as defined on this Wikipedia page:

          <https://en.wikipedia.org/wiki/ANSI\_escape\_code\#8\-bit>

#### Find String and Position Options

- `--find` (string)

  - Position start of output using (E)JES host FIND command syntax (below). Find positioning is done after --line and --time, but before --offset. Limit lines to found lines with --only. Limit excessive enumeration and provide context with --context.

          NOTE: To search for specific message IDs or find text in messages on the OPERLOG, use \-\-msgId or \-\-msgText instead.  OPERLOG message filtering Options show entire messages and may be more efficient.  Since these options position at the bottom of the log, specify \-\-line to position at the first message or specify \-\-find to find further refine your search.  Refer to OPERLOG Message Filtering Options for further alternatives to FIND.

          (E)JES Host FIND Command Syntax:  Only the find\-string is required.  It should be enclosed in single quotes if it contains spaces or special characters.  Case\-independent search is the default.  Case dependent is specified using c'find\-string'. Searching for double\-quotes is not supported.  (The search\-type arguments "next" and "prev" carry over  3270 display behavior.  In this program, "prev" means find the last occurrence above the last 53 lines of the log; the default "next" searches forward starting 53 lines before the bottom.)  Refer to the (E)JES Reference for the FIND command for detailed find syntax and option documention.

          \['|c'|p'|x'\]find\-string\['\] \[NEXT|prev|first|last\] \[CHARS|prefix|pre|suffix|suf|word\] \[startcol\[ endcol\]\]

    Allowed values: ^((?:c|p|x|)'.+'(?:c|p|x|)|[^'\s]+)(?:(?:\s+(first|last|next|prev|all)){0,1}(?:(?:\s+(chars|pre|prefix|suf|suffix|word)){0,1}(?:\s+(\d*\s+\d*|\d*)){0,2}){0,1}){0,1}$

- `--hilite` | `--highlight-find-text` | `--highlight` | `--ht` (array)

  - Use in conjunction with --find to highlight found strings using ANSI escape characters. If --no-color on is specified, the line will be prefixed with "=".

          If the built\-in highlight attribute isn't visible on your terminal, either change the foreground color or set the environment variable EJES\_LOG\_CLI\_ANSIFINDATTR to 8, 6, or 3.  0 to 256 are valid as defined on this Wikipedia page:

          <https://en.wikipedia.org/wiki/ANSI\_escape\_code\#8\-bit>

- `--only` | `-o` (boolean)

  - Output only lines marked by the host as found using the --find option. The --context option modifies this option by also outputing context lines following the found lines. Some OPERLOG message filtering options (e.g., --msgId and --msgTxt) may provide better results and will be more efficient and faster.

- `--context` | `--cx` (array)

  - Specify 2 to 49 lines of context after the found line when --only is specified. 5 is used if an argument is not specified. To display only found lines, do not specify --context.

    Allowed values: s, sep, separator, ^[1-4]\d*$|^[2-9]$

#### Positioning Options

- `--line` (array)

  - Position at a specific line in the log. With no argument, it positions to top of the displayable log (like the TOP command). Positioning done before --time, --find, and --offset.

    Allowed values: first, last, ^[1-9]\d*$

- `--head` (boolean)

  - Position at top of log same as --line without an argument. Positioning done before --time, --find, and --offset.

- `--time` (array)

  - Positions a time on the current day or to a time and date. With no argument, positions to the beginning of the day. Positioning done before --find and --offset, but after --line.

          The argument is hh:mm:ss:th\-date, where ss or ss:th and the date are optional.

    The date, if specified, is specified as yyyy.ddd, yyyy-ddd, yyyy/mm/dd, yyyy/dd/mm, mm/dd/yyyy, dd/mm/yyyy, yyyy-mm-dd, yyyy-dd-mm, mm-dd-yyyy, or dd-mm-yyyy. The Julian date form is always valid.

          The Gregorian date form depends upon your current date format setting, though both slash (/) and dash (\-) are accepted as separator characters.  Specify "?" to return the Gregorian date format and quit, i.e., \-\-time "?"

          Two copy\-paste date\-time formats are supported.  A date\-time may copied from the log and pasted, enclosed in quotes, after the \-\-time option.  Operlog: "yyyydddd hh:mm:ss.th".  Syslog: "yyyyddd hhmmsst".

    Allowed values: (?:^(20\d{5}) (\d{7})$)|(?:^(20\d{5}) ((\d\d:\d\d:\d\d.\d\d))$)|(?:^(\d\d\:\d\d(?:\:\d\d){0,2}(?:-(?:(?:\d{4}[.-]\d{3}$)|(?:^\d{4}(?:[\/|-]\d{2}){2}$)|(?:^(?:\d{2}[\/|-]){2}\d{4})))*){0,1}$|^\?$)

#### Positioning Offset Options

- `--offset` | `--off` (array)

  - Offset positioning by time or line count after the final position arrived at by message filtering, --line, --time, and --find. Optional directional indicators are next or + (later in log) or prev (earlier). If the directional indicator is omitted, earlier in the log is assumed. Valid trailing time indicators are s, m, h, or d. A number without a time indicator assumes h on OPERLOG, but on SYSLOG positions by adding to the current data set number (if 0, it positions at the top of the current data set). The l indicator is a line count indicator. Specify this to offset by n lines. Without an argument, prev4l is assumed, which is helpful when specifying --find to provide context even when -n 10 (the default) is specified.

    Allowed values: ^(\+|next|prev)*(\d+[smhdl]{0,1})$

#### OPERLOG Message Filtering Options

- `--system-name` | `--systemName` | `--sysname` | `--sn` (array)

  - Filter for up to 4 provided system name(s). Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. Note: The response time of the OPERLOG browser can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--job-name` | `--jobName` | `--jname` | `-j` (array)

  - Filter OPERLOG for up to 4 provided job names. Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--job-id` | `--jobId` | `--jid` (array)

  - Filter OPERLOG for up to 4 provided job ids, e.g, J0632369. Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--console` | `--con` (array)

  - Filter OPERLOG for up to 4 provided consoles. Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--message-id` | `--messageId` | `--msgId` | `--mi` (array)

  - Filter OPERLOG for up to 3 provided message ids of up to 12 characters. Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--message-text` | `--messageText` | `--msgText` | `--msgTxt` | `--mtxt` | `--mx` (array)

  - Filter OPERLOG for message text of up to 34 characters. Multiline messages are output in their entirety. Generic (*) and placeholder (%) mask characters allowed. To filter for strings inside a message's text, use generic characters, e.g., "*logon*". Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

- `--routing-codes` | `--routingCodes` | `--routing` | `-r` (array)

  - Filter OPERLOG for routing codes. Up to 34 characters that may be ALL, NONE, or a list of decimal routing codes or ranges. For example: 1,3,6-9,100-128. Multiline messages are output in their entirety. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

    Default value: ALL

- `--descriptor-codes` | `--descriptorCodes` | `--descriptor` | `--dc` (array)

  - Filter OPERLOG for descriptor codes. Up to 34 characters that may be ALL, NONE, or a list of decimal descriptor codes or ranges. For example: 1,3,6-9. Multiline messages are output in their entirety. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

    Default value: ALL

- `--window-bottom` | `--windowBottom` | `--winBot` | `--wb` | `--bot` | `--high-time-date` | `--htd` (array)

  - Filter OPERLOG by setting the time and optionally the date of the bottom of the log to use. Up to 23 characters.

          The boundary specifications may be either fixed time\-date values, e.g."16:00:12:90\-2021/02/12" (see “Time\-Date Values” in the (E)JES Reference) or calculated relative to the time stamp associated with the record shown at 57 lines from the bottom of the log at start\-up.

          A relative value is indicated by the presence of a next (\+) or previous preceding the boundary specification, e.g., prev1h. After the next or previous you may specify either a number of seconds, minutes, hours, or days as indicated by using a 's', 'm', 'h', or 'd' suffix. Assumes 'h' if omitted.

          Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

    Allowed values: ^(\+|next|prev)*(\d+[smhd]{0,1})$|(?:^(20\d{5}) ((\d\d:\d\d:\d\d.\d\d))$)|^(?:(\d\d\:\d\d(?:\:\d\d){0,2}(?:-(?:(?:\d{4}[.-]\d{3})|(?:\d{4}(?:[\/|-]\d{2}){2})|(?:(?:\d{2}[\/|-]){2}\d{4})))*){0,1}|\?)$

- `--window-top` | `--windowTop` | `--winTop` | `--wt` | `--top` | `--low-time-date` | `--ltd` (array)

  - Filter OPERLOG by setting the time and optionally the date of the top of the log to use. Up to 23 characters.

          The boundary specifications may be either fixed time\-date values, e.g."16:00:12:90\-2021/02/12" (see “Time\-Date Values” in the (E)JES Reference) or calculated relative to the time stamp associated with the record shown at 57 lines from the bottom of the log at start\-up.

          A relative value is indicated by the presence of a next (\+) or previous preceding the boundary specification, e.g., prev1h. After the next or previous you may specify either a number of seconds, minutes, hours, or days as indicated by using a 's', 'm', 'h', or 'd' suffix. Assumes 'h' if omitted.

          Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

    Allowed values: ^(\+|next|prev)*(\d+[smhd]{0,1})$|(?:^(20\d{5}) ((\d\d:\d\d:\d\d.\d\d))$)|^(?:(\d\d\:\d\d(?:\:\d\d){0,2}(?:-(?:(?:\d{4}[.-]\d{3})|(?:\d{4}(?:[\/|-]\d{2}){2})|(?:(?:\d{2}[\/|-]){2}\d{4})))*){0,1}|\?)$

- `--mpf-exit-flags` | `--mpfExitFlags` | `--mpf` (array)

  - Filter OPERLOG for MPF/Exit flags with a "value mask" of eight hexadecimal characters, e.g., 00000291. Use in conjunction with the "result directive" (see --result-directive).

          The filtering is performed by ANDing the hexadecimal value mask against a message’s MPF/Exit Flags value and then displaying the message based upon the result directive (zero or non\-zero).  For example, a mask and result directive of 00000001 and NZ will display messages that were suppressed by MPF. Specifying 00000001 and Z displays messages that were not suppressed.

          Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.  Multiline messages are output in their entirety.

    Default value: FFFFFFFF
    Allowed values: ^[0-9A-F]{8}$, ^[0-9a-f]{8}$

- `--result-directive` | `--resultDirective` | `--rd` (array)

  - Provide the result directive for the --mpf-exit-flags option (see the option for more information). A mask and result directive of 00000001 and NZ will display messages that were suppressed by MPF. A mask and result directive of 00000001 and Z displays messages that were not suppressed. Multiline messages are output in their entirety. Note: The response time can be seriously impacted by the use of filtering criteria that results in too few messages being considered for display.

    Default value: NZ
    Allowed values: NZ, Z, EQ, NE

#### Log Options

- `--logsys` | `-l` (string)

  - Specify a syslog to display by specifying the MVS name of a system in a JES2 environment. The current system is browsed if --logsys is not specified.

- `--syslog` | `--sys` (boolean)

  - Display the SYSLOG instead of the default log. Deprecated. Use the positional parameter instead.

    Default value: false

- `--operlog` | `--oper` (boolean)

  - Display the OPERLOG instead of the default log. Deprecated. Use the positional parameter instead.

    Default value: false

#### JES-type Options

- `--jes2` | `-2` (boolean)

  - Use the JES2 spooler instead of the default spooler.

    Default value: false

- `--jes3` | `-3` (boolean)

  - Use the JES3 or JES3plus spooler instead of the default spooler.

    Default value: false

- `--subsystem` (string)

  - Specify the JES spooler system to use instead of the default spooler.

#### EJES Connection Options

- `--protocol` | `--prot` (string)

  - Protocol used to access (E)JES server.

    Default value: https
    Allowed values: http, https

- `--host` | `-H` (string)

  - The (E)JES server host name.

- `--port` | `-P` (number)

  - The (E)JES server port.

    Default value: 443

- `--user` | `-U` (string)

  - Mainframe (E)JES user name, which can be the same as your TSO login.

- `--password` | `--pass` | `--pw` (string)

  - Mainframe (E)JES password, which can be the same as your TSO password.

- `--reject-unauthorized` | `--rejectunauthorized` | `--ru` (boolean)

  - Reject self-signed certificates.

    Default value: true

- `--base-path` | `--bp` (string)

  - The base path for your API mediation layer instance. Specify this option to prepend the base path to all (E)JES resources when making REST requests.

- `--color-scheme` | `--scheme` | `--cs` (string)

  - Accessibility option: Specify the name of a color scheme. User scheme files may also be created and specified to provide better contrast or to favor easier to see colors. For a how-to, use "zowe ejes emulate batch --helpApp scheme-info". Zowe ejes log stream ignores this option as it outputs plain text by default, only colorizing when ANSI color options are specified.

    Allowed values: dark, light, powershell, nono, none, user-scheme-file, list, help

    Default value: dark

- `--no-color` | `--nocolor` | `--nc` (string)

  - Accessibility option: Specify to prevent colorization of the CLI. Same effect as defining NO_COLOR or FORCE_COLOR=0.

#### EJES CLI Runtime Options

- `--enum-value` | `--enumval` | `--ev` (number)

  - Number of lines to retreieve per (E)JES API call. Overridden by the combination of --rfj and --line (-n). See --line.

    Default value: 200

- `--refresh-interval` | `--refreshInterval` | `--refresh` | `--ri` | `--sleep-interval` | `--sleep` | `-s` (number)

  - Number of seconds between (E)JES API calls in log stream command. The actual minimum and maximum interval is controlled by your host refresh command settings.

    Default value: 5

- `--debug` | `--dbg` | `--dv` | `-d` (number)

  - Invoke debugging code with additive flags. 1=request, 2=minimum response, 4=full response, 8=housekeeping, 16=show record info, 32=show fetch metadata.

    Default value: 0

- `--detailed-json` | `--detailedjson` | `--detail` | `--dj` (boolean)

  - Include metadata objects and arrays in --rfj output, not just an array of lines.

    Default value: false

#### Profile Options

- `--ejes-profile` | `--ejes-p` (string)

  - The name of a (ejes) profile to load for this command execution.

#### Examples

- Output 10 lines at the tail of the log:

  - `zowe ejes log stream`

- Output 40 lines at head of the log with no header or trailer lines. The -n option is an alias for --lines and -q is an alias for --quiet:

  - `zowe ejes log stream --head -n 40 -q`

- Stream the tail of the default log defined for your credentials until you press CTRL+C. The -f option is an alias for --follow:

  - `zowe ejes log stream --follow`

- Stream the tail of the syslog:

  - `zowe ejes log stream syslog --follow`

- Stream the tail of the operlog:

  - `zowe ejes log stream operlog --follow`

- Match and highlight user logons in output lines. (NOTE: This does not position to the string; it *only* highlights them *if* they are in the output.) Match can also work with a simple string, or a regex string with no forward slash characters, implying the "ig" flags (ignore-case and global-match):

  - `zowe ejes log stream --match "/[Ll]ogo.{1,2}|force|Signoff/g"`

- Match and mark user logons without ANSI color escape sequences. The --nc option is an alias for --no-color:

  - `zowe ejes log stream --match "/[Ll]ogo.{1,2}|force|Signoff/g" --nc on`

- Find your logon Id in the log:

  - `zowe ejes log stream --find yourLogonId`

- Find your logon Id in the log and highlight the found text:

  - `zowe ejes log stream --hilite --find yourLogonId`

- Find your logon id in the log with a few lines above it for context. The --offset option is down 4 lines (prev4l) if the argument is not specified:

  - `zowe ejes log stream --find yourLogonId --offset`

- Find your TSO logons and logoffs for today by specifying you logon id followed by "- log" in the log. Note that if the find string includes spaces or special characters, you need to enclose it in single-quotes. Find without a find without a search type uses NEXT, searching forward from a position. Using the --time option without an argument positions to the start of the current day before finding. Without the --time option, the default position is 53 lines from the bottom. (NOTE: The space after the trailing apostrophe and before the double quote is a work-around for a zowe parsing issue.):

  - `zowe ejes log stream --find "'yourLogonId - log' " --time`

- Find your unix home directory in the log. Note that if find string is case sensitive, you need to enclose it in single-quotes prefixed with the letter c, e.g., c'String':

  - `zowe ejes log stream --find "c'DSN=/u/userName' last"`

- Find beginning of speed boost with highlighting:

  - `zowe ejes log stream --find "'speed boost is active' first" --hilite`

- Find beginning of speed boost but mark found lines without ANSI color escape sequences. The --ht option is an alias for --hilite and --nc is an alias for --no-color:

  - `zowe ejes log stream --find "'speed boost is active' first" --ht --nc on`

- Find all speed boost messages with highlighting and only output found lines:

  - `zowe ejes log stream --find "'speed boost is active' first" --ht --only -n all`

- Find all speed boost messages with highlighting and output five lines of context (the default):

  - `zowe ejes log stream --find "'speed boost is active' first" --ht --only --context -n all`

- Filter for IPL and boost informational messages that appear in the IEA681I message. The message can include generic characters to specify classes or subclasses of messages. The entire multiline message is output if the message is multiline. Other OPERLOG filtering options can be found under Message Filters Options:

  - `zowe ejes log stream --msgId "IEA681I"`

- Filter for all informational IEA messages. The % character is a placeholder that matches any character. The entire multiline message is output if the message is multiline. Other OPERLOG filtering options can be found under Message Filters Options:

  - `zowe ejes log stream --msgId "IEA%%%I"`

- Filter for "boost" in the text of any message. Note the use of the generic character * that matches any number of characters before or after the string. These are necessary for this type of search. The entire multiline message is output if the message is multiline. Other OPERLOG filtering options can be found under Message Filters Options:

  - `zowe ejes log stream --msgTxt "*boost*"`

- Filter using descriptor codes for audible alarm errors and warning messages with MCS console color emulation on. The program will beep.The option --dc is an alias for --descriptorCodes. OPERLOG filtering options can be found under Message Filt ers Options:

  - `zowe ejes log stream --descriptorCodes "1,2,11" --mcs`

- Find all system messages that required action for the hour after midnight. Specifying --only shows just found lines. Specifying --lines with "1h" tells the program to output lines up to one hour from the first line output. The --top option here specifies a time without a date, which means the current day. This logically sets the top of the log, windowing it, to midnight today (with no lines above it). Specifying --find with the first verb tells to search from the top. The character in the find string has a special meaning indicating that a message requires action. The special characters "|", "-", "@", " * ", and "+" can be indexed from column 54 and " * " is a column 4 character, thus 58 below.

  https://www.ibm.com/docs/en/zos/2.4.0?topic=consoles\-special\-screen\-characters:

  - `zowe ejes log stream --find "'*' first 58 58" --only --top "00:00" --lines 1h`

- Same result as previous example but with different options and colorized to emulate an MCS color console. Specifying --time without an argument positions at the beginning of the current day. The difference from above is that --top sets the first line of the log the program sees and positions at the bottom. The --time option positions before --find runs. No directional argument is specified on the --find option so it runs starting as positioned by the --time option.:

  - `zowe ejes log stream --find "'*' 58 58" --only --time --lines 1h --mcs`

- Stream the tail of the log until you press CTRL+C. The -f option is an alias for --follow:

  - `zowe ejes log stream --follow`