// ARB — LANGUAGE REFERENCE

arb v0.1.1 · pipe → dynamic TUI/web · original language on fusevm + Cranelift JIT · jq/xpath/css/yq superset · Tcl/Tk-flavored DSL · MIT · in active development

Docs Report GitHub
// Color scheme

>_LANGUAGE REFERENCE

Every widget, query verb, directive, action, and input mode the current arb build implements. This page is generated from the language-server corpus (src/lsp.rs) by the gen-docs binary, so it stays in sync with what the runtime and editor tooling actually know about. The full grammar is in SPEC.md.

Widgets

# text

Shows the last stream line, or a scalar/top-pair result, in a bordered pane.

text .t  ·  source .t { in; last }

# tail

Scrolling list of the newest lines that fit (tail -f); -limit/-lines caps rows.

tail .log  ·  source .log { in }

# list

Scrollable list of stream lines in a bordered pane; -limit caps rows shown.

list .rows  ·  source .rows { in }

# gauge

Renders a scalar as a progress bar filled to value/max (-max, default 100).

gauge .cpu -max 100  ·  source .cpu { in; field 3; sum }

# bars

Horizontal bar chart of tally/count pairs; -top caps the number of bars (def 20).

bars .top  ·  source .top { in; field 1; tally }

# histo

Bar chart of value-distribution pairs; same rendering as bars, -top caps bars.

histo .h  ·  source .h { in; field 2; tally }

# spark

Compact braille sparkline of the numeric series, newest points that fit width.

spark .s  ·  source .s { in; field 2 }

# chart

Braille line chart of the numeric series with auto-scaled x/y axes.

chart .c  ·  source .c { in; field 2 }

# linegauge

Thin one-line progress bar (value/max) for tight cells — a compact gauge.

linegauge .load -max 8  ·  source .load { in; count }

# scatter

Braille scatter plot of the numeric series (higher resolution than spark).

scatter .lat  ·  source .lat { in; field 2 }

# sparkline

Block-bar sparkline (ratatui Sparkline) of the numeric series; fixed-height bars.

sparkline .rps  ·  source .rps { in; rate }

# map

Braille world map plotting `lon lat` points from the stream (-res high|low).

map .geo  ·  source .geo { in }

# calendar

Month calendar; days appearing as YYYY-MM-DD in the stream are highlighted.

calendar .cal  ·  source .cal { in }

# logview

Log tail tinted by detected level (ERROR/WARN/INFO/DEBUG); theme-aware.

logview .log  ·  source .log { in }

# heatmap

Numeric series as a grid of shade-scaled cells (GitHub-contribution style).

heatmap .h  ·  source .h { in; field lat }

# treemap

Tally/count pairs as proportional labeled rectangles across the palette.

treemap .t  ·  source .t { in; field svc; tally }

# gantt

`label start end` lines as horizontal bars on a shared time axis.

gantt .g  ·  source .g { in }

# diff

Lines tinted by leading char: + add (green), - remove (red), @ hunk.

diff .d  ·  source .d { in }

# logo

The ratatui braille wordmark, centered — a decorative splash.

logo .brand

# clear

A blank spacer (occupies a grid cell without drawing) to open space.

clear .gap

# rule

A divider line in the theme accent (horizontal, or -dir vertical).

rule .sep

# table

Columnar table of records; -cols sets headers, newest rows that fit are shown.

table .rows -cols "a,b,c"  ·  source .rows { in }

# tabs

Tab bar from -tabs {a b}; first tab selected (labelled selector, no per-tab body).

tabs .t -tabs {a b c}

# block

Bordered container box rendering its bound stream content as a list.

block .b -title Logs  ·  source .b { in }

# frame

Framed container rendering its bound stream content as a list.

frame .f  ·  source .f { in }

# input

Editable text field; its value is spliced into pipelines via apply .name.

input .q  ·  out { apply .q }

# select

Interactive fuzzy-select over the stream; type to filter, Tab marks, Enter emits.

select .k -prompt pick  ·  source .k { in }

# sel

In-dashboard selection list over its own source; the highlighted row is published as .<path>.sel.

sel .ps  ·  source .ps { in }  ·  out { where match(.ps.sel) }

# filter

Labelled filter control; its value drives where match(.name) / apply.

filter .q  ·  out { where match(.q) }

# facet

Multi-select of values (-opts or distinct -field); drives where <field> in .name.

facet .lv -field level  ·  out { where level in .lv }

# slider

Numeric control (-min/-max/-step) driving where <field> < .name; arrows adjust.

slider .th -field lat -max 5  ·  out { where lat < .th }

# check

Boolean toggle (-label); its value is the string "1" or "0".

check .on -label live

Query verbs

# find

Parse stream as HTML, emit the outer HTML of each element matching the selector.

in.html; find a; attr href

# attr

From element fragments, emit each element's named attribute; drop those lacking it.

in.html; find a; attr href

# text

From element fragments, emit each element's inner text; non-elements pass through.

in.html; find h2; text

# match

Keep lines matching the regex.

in; match /ERROR/

# grep

Keep lines matching the regex.

in; grep /ERROR/

# reject

Drop lines matching the regex.

in; reject /^#/

# grepv

Drop lines matching the regex.

in; grepv /^#/

# field

Replace each line with a selected field (whitespace column or JSON key path).

in.json; field status; tally

# fields

Project multiple 1-based whitespace columns, space-joined, in the given order.

in; fields 1 3

# each

Flatten JSON-array lines into one line per element; non-array lines pass through.

in.json; field users; each; field name

# count

Reduce to the current line count (scalar).

in; count

# rate

Reduce to lines-per-second over the elapsed window (scalar).

in; rate

# tally

Group identical lines and count them, sorted by count desc then key asc.

in; field status; tally

# sum

Sum of lines parsed as numbers; non-numeric lines are ignored (scalar).

in; field 3; sum

# min

Minimum of numeric lines, or 0 if none (scalar).

in; field 2; min

# max

Maximum of numeric lines, or 0 if none (scalar).

in; field 2; max

# avg

Mean of numeric lines, or 0 if none (scalar).

in; field 2; avg

# keys

Flatten a JSON object's keys into one line each; non-object lines pass through.

in.json; keys; tally

# vals

Flatten a JSON object's values into one line each; non-object lines pass through.

in.json; vals

# pick

Project a JSON object to the named keys, keeping order; missing keys dropped.

in.json; pick ts msg

# sort

Sort the lines; -n sorts numerically, -r reverses.

in; tally; sort -n -r

# uniq

Drop duplicate lines globally, keeping the first occurrence.

in; sort; uniq

# rev

Reverse the order of the lines.

in; rev

# first

Keep only the first line.

in; first

# last

Keep only the last line.

in; last

# upper

Uppercase each line.

in; upper

# lower

Lowercase each line.

in; lower

# trim

Strip leading and trailing whitespace from each line.

in; trim

# replace

Regex replace-all per line (replace /RE/ TO); TO may use $1 captures.

in; replace /foo/ bar

# join

Collapse all lines into one, joined by a separator (default a space).

in; field 1; join ,

# nth

Keep only the Nth line (1-based).

in; nth 3

# take

Keep the first N lines.

in; tally; take 10

# drop

Drop the first N lines.

in; drop 1

# calc

Reduce to a scalar from an arithmetic expression over the line count (x).

in; count; calc x * 100

# where

Keep lines whose numeric value / field predicate holds (fusevm or Rust eval).

in.json; where lat < 5

# map

Replace each line with an expression's value (field-aware; x = line-as-number).

in; map x * 2

# via

Fan the stream across a supervised pool of actor NAME in parallel (via NAME * N; reply is the output line).

in; via sq * 8

# sort_by

Stable-sort JSON records by FIELD (numeric if all parse, else lexicographic).

in.json; sort_by ts

# unique_by

Keep the first record per distinct FIELD value, preserving input order.

in.json; unique_by id

# count_by

Group JSON records by FIELD and count; value->count sorted by count desc.

in.json; count_by level

# group_by

Group lines by FIELD into one JSON-array line per value, keys ascending.

in.json; group_by level

# min_by

Emit the single record whose numeric FIELD is smallest.

in.json; min_by lat

# max_by

Emit the single record whose numeric FIELD is largest.

in.json; max_by lat

# has

Keep only JSON-object lines that contain KEY; all other lines are dropped.

in.json; has error

# entries

Expand each JSON object into one key/value object line per key (jq to_entries).

in.json; entries

# flatten

Emit each element of JSON-array lines, one level deeper than each.

in.json; flatten

# add

Reduce a JSON array line to one value (sum numbers, else concat their strings).

in.json; add

# over

Keep lines parsing as a number strictly greater than N; drop non-numeric.

in; field 2; over 100

# under

Keep numeric lines strictly less than N; drop non-numeric lines.

in; field 2; under 10

# between

Keep numeric lines x where lo <= x <= hi inclusive; drop non-numeric lines.

in; between 1 10

# enumerate

Prefix each line with its 1-based index and a tab.

in; enumerate

# words

Split each line on whitespace and emit one word per line.

in; words; tally

# dedup

Collapse runs of adjacent identical lines to one (classic uniq).

in; dedup

# tailn

Keep only the last N lines.

in; tailn 5

# pad

Right-pad each line with spaces to a minimum visible width N (no truncation).

in; pad 10

# lpad

Left-pad each line with spaces to a minimum width N.

in; lpad 8

# grepf

Keep lines whose FIELD (JSON key or 1-based column) matches the regex.

in.json; grepf status /5\d\d/

# apply

Placeholder replaced at render by the pipeline typed into input .name; else no-op.

source .out { in; apply .q }

# basename

Path basename: the part after the last / (the whole line if none).

in; basename

# dirname

Path dirname: the part before the last / (. if none).

in; dirname

# commafy

Group a numeric line's integer part with thousands separators; else pass through.

in; sum; commafy

# bytes

Humanize a byte count (1024-based): 1536 -> 1.5 KB; non-numeric passes through.

in; field 2; bytes

# duration

Humanize seconds: 3661 -> 1h 1m; non-numeric lines pass through.

in; field 2; duration

# flip

Reverse the Unicode characters of each line.

in; flip

# b64

Base64-encode each line.

in; b64

# b64d

Base64-decode each line; invalid or non-UTF8 lines pass through unchanged.

in; b64d

# hex

Lowercase hex-encode each line, two hex digits per UTF-8 byte.

in; hex

# unhex

Decode a hex string to UTF-8; on any error the line passes through unchanged.

in; unhex

# urlenc

Percent-encode each line, escaping every non-alphanumeric byte (RFC 3986).

in; urlenc

# urldec

Percent-decode each line to UTF-8; invalid UTF-8 passes through unchanged.

in; urldec

# extract

Emit the first regex match per line (group 1 if any); drop lines with no match.

in; extract /(\d+)/

# split

Explode each line by the literal DELIM into multiple lines (one part per line).

in; split ,

# substr

Character substring [A,B) 0-based, clamped to the line length.

in; substr 0 8

# chars

Explode each line into one output line per Unicode character.

in; chars

# title

Title-case each line: capitalize each word's first letter, lowercase the rest.

in; title

# repeat

Replace each line with its content repeated N times, concatenated.

in; repeat 3

# set

Set key K to string value V in each JSON object line; non-objects pass through.

in.json; set env prod

# del

Remove key K from each JSON object line; non-object lines pass through.

in.json; del debug

# rename

Rename JSON object key OLD to NEW, keeping the value; no-op if OLD absent.

in.json; rename ts time

# default

Set string key K to V only when K is absent from the JSON object.

in.json; default env dev

# merge

Reduce all JSON object lines into one object (later keys win); emits one line.

in.json; merge

# floor

Floor each numeric line to the nearest lower integer; non-numeric passes through.

in; floor

# ceil

Round each numeric line up to the nearest integer; non-numeric passes through.

in; ceil

# round

Round each numeric line to the nearest integer.

in; round

# abs

Absolute value of each numeric line.

in; delta; abs

# clamp

Clamp each numeric line into the inclusive range [LO, HI]; non-numeric untouched.

in; clamp 0 100

# len

Replace each line with its character count.

in; len

# length

jq length: array element count / object key count / string char count / |number| / null 0; non-JSON falls back to char count.

in.json; length

# wc

Replace each line with its word count.

in; wc

# index

Keep only the Nth line (1-based); out-of-range yields no lines.

in; index 3

# cut

Split each line by DELIM and keep the Nth (1-based) field.

in; cut , 2

# contains

Keep lines containing a literal substring.

in; contains error

# starts

Keep lines starting with a literal prefix.

in; starts GET

# ends

Keep lines ending with a literal suffix.

in; ends .json

# nonempty

Drop empty or whitespace-only lines.

in; nonempty

# numeric

Keep only lines that parse as a number.

in; numeric; avg

# distinct

Reduce to the count of distinct lines (scalar).

in; distinct

# sample

Keep every Nth line (1-based).

in; sample 10

# range

Max minus min of numeric lines (scalar).

in; field 2; range

# bins

Bucket numeric lines into N equal-width ranges -> (range, count) pairs.

in; bins 10

# cumsum

Running cumulative total of the numeric series.

in; cumsum

# delta

Consecutive differences of the numeric series (n values -> n-1 deltas).

in; delta

# ewma

Exponentially-weighted moving average, smoothing factor alpha in (0,1]; s0=x0.

in; ewma 0.3

# sma

Simple moving average over a trailing window of N (length-preserving).

in; sma 5

# median

Median of numeric lines (scalar).

in; field 2; median

# percentile

Nth percentile (0-100) of numeric values, linear interpolation between ranks.

in; percentile 95

# p50

50th percentile (median) of the numeric values (scalar).

in; field 2; p50

# p90

90th percentile of the numeric values (scalar).

in; field 2; p90

# p95

95th percentile of the numeric values (scalar).

in; field 2; p95

# p99

99th percentile of the numeric values, for latency tails (scalar).

in; field 2; p99

# stddev

Population standard deviation of numeric lines (scalar).

in; field 2; stddev

# product

Product of numeric lines (scalar).

in; product

# append

Suffix every line with a literal string.

in; append !

# prepend

Prefix every line with a literal string.

in; prepend >>

# slice

Keep lines from index A to B inclusive (1-based).

in; slice 1 10

# sel

Parse stream as HTML, emit each CSS-selector match's text (or -attr value).

in.html; sel { div.card h2 }

Directives

# import

Inline a module (stdlib preset or user .arb file) into the spec.

import http

# import as

Build a module into namespace ALIAS, prefixing its names, then merge it in.

import gauges as g

# source

Attach a query pipeline (body must start with in) as a widget's data source.

source .status { in.json; field status; tally }

# search

Attach a select widget's fuzzy-match key pipeline; the row still shows source.

search .k { in; field 2 }

# bind

Bind a control key to an action (set|quit|beep|alert|flash|exec, or a { } block).

bind C-q quit

# expect

Fire an action when a stream line matches /regex/ (event-driven reaction).

expect /5\d\d/ { flash .log red }

# timeout

Fire an action when the stream is idle for a duration (Ns/Nms/Nm).

timeout 5s alert "stream idle"

# out

Apply a query pipeline to the stream and write it to stdout (modify a pipe).

out { where match(.q) }

# grid

Place a widget in the layout grid (-row/-col, -span/-rowspan/-colspan).

grid .cpu -row 0 -col 0 -span 2

# rows

Size the grid's row tracks: N fixed cells, N% percentage, or N*/* proportional weight.

rows "1 2 1"

# cols

Size the grid's column tracks: N fixed cells, N% percentage, or N*/* weight.

cols "20 * 2*"

# gap

Blank cells between grid rows/columns (default 0).

gap 1

# layout

Auto-tile direction when no widget has a grid cell (horizontal | vertical).

layout horizontal

# theme

Set the color palette: one of 31 built-ins (see arb --list-themes) or `theme custom c1..c6`.

theme neon-noir

# configure

Merge new -opts into an already-declared widget (build-time; later keys win).

.cpu configure -max 200

# actor

Declare a message-handling actor with a single scalar state and one handler per message.

actor sq(state) { on job(x) { reply x * x } }

# on

A message handler inside an actor body: on MSG(params) { stmts; reply EXPR }.

on job(x) { reply x * 2 }

# reply

Inside a handler, send an expression's value back to an ask/via caller.

reply state + x

# spawn

Bind a session actor: spawn NAME = ACTOR(init); tell/ask drive it (distinct from the spawn CMD source).

spawn w = worker(0)

# pool

Bind a supervised session pool: pool NAME = ACTOR * N (a dead worker is respawned).

pool p = worker * 8

# supervise

Set a ref's crash policy: supervise NAME { on crash { restart | stop } } (default restart).

supervise p { on crash { restart } }

Bind / expect actions

# quit

Quit the TUI.

bind C-q quit

# beep

Ring the terminal bell (0x07 after the next draw).

expect /panic/ beep

# alert

Flash a message in the status bar for a few seconds.

timeout 5s alert "stream idle"

# exec

Run a shell command, fire-and-forget; never waits or blocks the loop.

expect /down/ exec "notify-send arb"

# flash

Tint a widget's border/accent for a few seconds (-color, default yellow).

expect /5\d\d/ flash .log red

# set

Set an input .name widget's value; with out { apply .name } reshapes the live pipe.

bind C-a set .q ERROR

# tell

Post a message to a session actor/pool, fire-and-forget: tell REF MSG(args).

bind C-t tell w job(5)

# ask

Ask a session actor/pool and store the reply into control .CTRL: ask .CTRL REF MSG(args).

bind C-a ask .out p job(.th)

Input modes

# in

Begin the pipeline, reading the raw stdin stream line by line.

source .log { in }

# in.json

Begin the pipeline reading stdin (JSON-lines intent; a marker, same as in).

source .s { in.json; field status; tally }

# in.html

Begin the pipeline reading stdin as HTML (marker, same as in; use with sel/find).

source .s { in.html; find a; attr href }

# in.xml

Begin the pipeline reading stdin as XML (marker, same as in).

source .s { in.xml; find item; text }

# in.logfmt

Begin the pipeline reading stdin as logfmt (marker, same as in).

source .s { in.logfmt; field level; tally }

# in.csv

Begin the pipeline treating stdin as CSV: the header row keys each data row into a JSON object (field NAME works).

source .rows { in.csv; field name; tally }

# in.tsv

Begin the pipeline treating stdin as TSV: a tab-separated header keys each data row into a JSON object (field NAME works).

source .rows { in.tsv; field name; tally }

# in.yaml

Begin the pipeline parsing stdin as YAML (--- multi-doc), emitting each document as a JSON line.

source .s { in.yaml; field status; tally }

# in.yml

Alias of in.yaml: parse stdin as YAML into JSON lines.

source .s { in.yml; field status; tally }

# in.toml

Begin the pipeline parsing stdin as one TOML document, emitted as a JSON object line.

source .cfg { in.toml; field version }

Stdlib presets

Prebuilt dashboards shipped with arb; drop one in with import NAME or auto-selected by stream sniffing.

# activemq

broker queue depth/throughput dashboard from activemq dstat queues

activemq dstat queues | arb -p activemq

# ansible

task recap by status and slowest hosts

ansible-playbook site.yml | arb -p ansible

# apache

access-log status codes, top client IPs, request volume, and live requests

tail -f access.log | arb -p apache

# arangodb

server-log dashboard: log-level mix, error count, live log tail

arangod --log.file - 2>&1 | arb -p arangodb

# argocd

GitOps app sync-status and health dashboard from `argocd app list`

argocd app list | arb -p argocd

# aws

CloudTrail event names, error counts, and request latency

aws cloudtrail lookup-events --output json | jq -c '.Events[]' | arb -p aws

# azure

az CLI activity-log operations, statuses, and durations

az monitor activity-log list -o json | jq -c '.[]' | arb -p azure

# beanstalkd

work-queue depth dashboard from the `stats` YAML dump

echo stats | nc localhost 11300 | arb -p beanstalkd

# btrfs

subvolume dashboard from btrfs subvolume list

btrfs subvolume list / | arb -p btrfs

# buildah

OCI image inventory dashboard from buildah images output

buildah images | arb -p buildah

# buildkite

build/job state dashboard from Buildkite builds JSON

buildkite-agent api builds | arb -p buildkite

# caddy

HTTP status/latency/level dashboard from Caddy JSON access logs

tail -f access.json | arb -p caddy

# cassandra

cluster node status dashboard from nodetool status

nodetool status | arb -p cassandra

# cdk

CloudFormation resource-status dashboard from cdk deploy output

cdk deploy | arb -p cdk

# celery

task events by state, runtimes, and slow-task tail

celery events --dump --json | arb -p celery

# chef

chef-client run resource-action dashboard from converge output

chef-client | arb -p chef

# cilium

endpoint policy/status dashboard from cilium endpoint list

cilium endpoint list | arb -p cilium

# circleci

self-hosted runner fleet dashboard from circleci runner instance list --json

circleci runner instance list <namespace> --json | arb -p circleci

# clickhouse

query_log dashboard from clickhouse-client TSVWithNames output

clickhouse-client --format=TSVWithNames -q "SELECT type, query_duration_ms, query FROM system.query_log" | arb -p clickhouse

# cloudformation

stack status dashboard from list-stacks output

aws cloudformation list-stacks --query 'StackSummaries[].[StackStatus,StackName]' --output text | arb -p cloudformation

# cockroachdb

node liveness/health dashboard from cockroach node status

cockroach node status --format=csv | arb -p cockroachdb

# collectd

live metric dashboard from collectd PUTVAL plaintext protocol

collectd -T | arb -p collectd

# concourse

CI build status dashboard from fly builds output

fly -t main builds | arb -p concourse

# conntrack

live NAT/connection tracking by protocol, state, and byte volume

conntrack -E -o extended | arb -p conntrack

# consul

service health check status and top failing checks

consul watch -type checks -format json | arb -p consul

# containerd

task status dashboard from ctr tasks ls

ctr tasks ls | arb -p containerd

# couchdb

log-level, error count, and request dashboard from CouchDB logs

tail -f couch.log | arb -p couchdb

# crictl

CRI container state dashboard from crictl ps

crictl ps -a | arb -p crictl

# curl

HTTP status distribution, avg transfer time, live request log

curl -sw 'code=%{http_code} time=%{time_total} size=%{size_download}\n' -o /dev/null $URLS | arb -p curl

# datadog

agent check status dashboard from datadog-agent status

datadog-agent status | arb -p datadog

# dgraph

server-log dashboard (glog severity tally + error count) from Dgraph Alpha/Zero logs

dgraph alpha 2>&1 | arb -p dgraph

# dig

record types and TTLs from dig answer-section output

dig example.com ANY | arb -p dig

# dmesg

kernel ring buffer: subsystem activity, error count, live log

dmesg | arb -p dmesg

# docker

container CPU/memory dashboard from live docker stats

docker stats --no-stream | arb -p docker

# doctl

droplet fleet dashboard from doctl compute droplet list

doctl compute droplet list | arb -p doctl

# drone

Drone CI build dashboard from drone build ls output

drone build ls <repo> | arb -p drone

# duckdb

query-result dashboard from duckdb CSV output

duckdb -csv -c "SELECT ..." | arb -p duckdb

# dynamodb

item dashboard from a DynamoDB scan/query JSON item stream

aws dynamodb scan --table T --output json | jq -c '.Items[]' | arb -p dynamodb

# elasticsearch

JSON log levels, mean query duration, and live log tail

tail -f /var/log/elasticsearch/es.json | arb -p elasticsearch

# envoy

response codes, upstream latency, and top authorities

tail -f access.json | arb -p envoy

# etcd

cluster log levels, error/warn count, and live message tail (zap JSON)

etcd 2>&1 | arb -p etcd

# fail2ban

banned IPs, jail activity, and ban-attempt counts from the log

tail -f /var/log/fail2ban.log | arb -p fail2ban

# fluxcd

reconciliation health from flux get output (ready/suspended tally, resource count, messages)

flux get kustomizations -A | arb -p fluxcd

# fly

live dashboard from Fly.io machine logs (level + region tally, raw tail)

fly logs | arb -p fly

# gcloud

compute instance states and error-log severity mix

gcloud compute instances list --format=json | arb -p gcloud

# gh

pull-request states, open count, and recent titles

gh pr list --state all --json state,title,additions | arb -p gh

# git

recent commit activity from git log

git log --oneline | arb -p git

# gitlabrunner

CI job dashboard from gitlab-runner JSON structured logs

gitlab-runner run --log-format json | arb -p gitlabrunner

# grafana

server log dashboard from Grafana JSON structured logs

grafana server | arb -p grafana

# gunicorn

response status codes, slow requests, and live access log

gunicorn app:app --access-logformat '%(s)s %(D)s %(U)s' 2>&1 | arb -p gunicorn

# haproxy

JSON access log: status codes, backend latency, live requests

tail -f /var/log/haproxy.json | arb -p haproxy

# hcloud

server status dashboard from hcloud server list

hcloud server list | arb -p hcloud

# helm

release status dashboard from helm list JSON

helm list -A -o json | arb -p helm

# heroku

router-log dashboard: HTTP status mix, per-dyno traffic, platform error codes

heroku logs -t | arb -p heroku

# htop

process state mix, mean CPU load, and busiest processes

htop -C | arb -p htop

# http

access-log dashboard: status codes, top paths, live tail (JSON logs).

tail -f access.json | arb -p http

# icinga

service check-state dashboard from icingacli monitoring list

icingacli monitoring list | arb -p icinga

# iftop

bandwidth-by-host dashboard from iftop text-mode output

iftop -t -s 5 | arb -p iftop

# influxdb

Flux query dashboard from influx annotated-CSV output

influx query --raw 'from(bucket:"x")|>range(start:-1h)' | arb -p influxdb

# iostat

per-device I/O: tps by device, peak read throughput, raw stream

iostat 1 | arb -p iostat

# iptables

packet counts by target and high-traffic source addresses

iptables -L -v -n | arb -p iptables

# istioctl

proxy sync-status dashboard from istioctl proxy-status

istioctl proxy-status | arb -p istioctl

# jaeger

span dashboard from Jaeger JSON trace output

jaeger query --json | arb -p jaeger

# jenkins

CI job status dashboard from Jenkins REST API job JSON

curl -s .../api/json?tree=jobs[name,color] | jq -c '.jobs[]' | arb -p jenkins

# journalctl

syslog priority levels, top units, and error count

journalctl -o json -f | arb -p journalctl

# json

shape of a JSON-lines stream: key frequency + live tail.

cat events.json | arb -p json

# k8s

pod status breakdown from kubectl get pods

kubectl get pods | arb -p k8s

# kafka

consumer-group lag: per-topic message counts, peak lag, raw rows

kafka-consumer-groups --bootstrap-server localhost:9092 --describe --group app | arb -p kafka

# kubectx

Kubernetes context inventory dashboard from kubectx output

kubectx | arb -p kubectx

# kustomize

resource kind/apiVersion dashboard from kustomize build YAML

kustomize build overlays/prod | arb -p kustomize

# lighttpd

HTTP status + client dashboard from combined access logs

tail -f access.log | arb -p lighttpd

# linkerd

mesh success-rate & RPS dashboard from linkerd viz stat

linkerd viz stat deploy | arb -p linkerd

# linode

instance status/region dashboard from linode-cli text output

linode linodes list --text | arb -p linode

# logs

level breakdown + live tail for a JSON log stream.

kubectl logs -f deploy/api | arb -p logs

# loki

log-level dashboard from logcli query output

logcli query '{job="app"}' --tail | arb -p loki

# mariadb

connection command mix from SHOW PROCESSLIST output

mariadb -e "SHOW PROCESSLIST" | arb -p mariadb

# memcached

command mix and slow-item sizes from stats output

memcached-tool 127.0.0.1:11211 stats | arb -p memcached

# mongodb

mongod JSON log: severity mix, components, and slow-op messages

tail -f /var/log/mongodb/mongod.log | arb -p mongodb

# mssql

live session/request dashboard from sqlcmd output

sqlcmd -Q "SELECT session_id,status,wait_type FROM sys.dm_exec_requests" | arb -p mssql

# mtr

per-hop latency and packet-loss dashboard from an mtr report

mtr -r target | arb -p mtr

# mysql

live SHOW PROCESSLIST: command mix, longest query time, running SELECTs

mysql -e 'SHOW PROCESSLIST' | arb -p mysql

# nagios

service-state dashboard (OK/WARNING/CRITICAL/UNKNOWN) from Nagios status output

nagios status.dat | arb -p nagios

# nats

subject traffic dashboard from a live nats subscription

nats sub ">" | arb -p nats

# neo4j

node-label distribution from cypher-shell CSV query results

cypher-shell --format plain "MATCH (n) RETURN labels(n)[0] AS label, n.name AS name" | arb -p neo4j

# netdata

realtime health-alarm dashboard from the alarms JSON stream

curl -s localhost:19999/api/v1/alarms?all | arb -p netdata

# nethogs

per-process bandwidth dashboard from tracemode output

nethogs -t | arb -p nethogs

# netstat

TCP/UDP connection dashboard from netstat -an

netstat -an | arb -p netstat

# newrelic

APM entity health dashboard from newrelic CLI JSON output

newrelic apm application list | arb -p newrelic

# nginx

access-log dashboard from JSON access logs

tail -f access.json | arb -p nginx

# nmap

port/state/service dashboard from a standard nmap scan

nmap -p- host | arb -p nmap

# nomad

allocation client statuses and slow evals from event-stream JSON

nomad monitor -json | arb -p nomad

# nsq

topic/channel depth + throughput from nsq_stat polling output

nsq_stat --topic=events | arb -p nsq

# nums

quick stats for a numeric stream.

seq 1 100 | arb -p nums

# nvme

NVMe device inventory dashboard from `nvme list`

nvme list | arb -p nvme

# opensearch

cluster index health dashboard from _cat/indices output

curl -s localhost:9200/_cat/indices?v | arb -p opensearch

# packer

build dashboard from machine-readable output

packer build -machine-readable . | arb -p packer

# pgbouncer

connection-pool log: severity mix, top databases, error rate

tail -f pgbouncer.log | arb -p pgbouncer

# phpfpm

worker-state dashboard from a PHP-FPM full status dump

SCRIPT_NAME=/status cgi-fcgi -bind -connect 127.0.0.1:9000 | arb -p phpfpm

# podman

rootless container status/image dashboard from podman ps

podman ps | arb -p podman

# postgres

jsonlog severity mix, slowest query duration, live message tail

tail -f /var/log/postgresql/postgresql.json | arb -p postgres

# prometheus

exposition metrics: sample counts by name and value range

curl -s localhost:9090/metrics | arb -p prometheus

# ps

process snapshot: process count, owners, total CPU load

ps aux | arb -p ps

# pulsar

live event dashboard from JSON messages consumed off a Pulsar topic

pulsar-client consume -n 0 -s sub my-topic | arb -p pulsar

# pulumi

resource operation dashboard from pulumi preview output

pulumi preview | arb -p pulumi

# puma

HTTP status/throughput dashboard from Puma's common-log request output

puma 2>&1 | arb -p puma

# puppet

severity/change dashboard from a puppet agent run

puppet agent -t | arb -p puppet

# questdb

query-result dashboard from CSV exported via the /exp REST endpoint

curl -G 'http://localhost:9000/exp' --data-urlencode 'query=select * from trades' | arb -p questdb

# rabbitmq

queue depths, consumer totals, and per-queue state from rabbitmqctl

rabbitmqctl list_queues name messages consumers state | arb -p rabbitmq

# rclone

object-store listing dashboard from rclone ls output

rclone ls remote:bucket | arb -p rclone

# redis

command frequency from redis-cli MONITOR

redis-cli MONITOR | arb -p redis

# riak

cluster membership dashboard from riak-admin member-status

riak-admin member-status | arb -p riak

# salt

minion return dashboard from salt CLI output

salt '*' test.ping | arb -p salt

# sar

CPU utilization, load, and memory pressure from sar samples

sar -u -q -r 1 | arb -p sar

# scaleway

instance server state dashboard from scw list output

scw instance server list | arb -p scaleway

# scylla

ScyllaDB cluster node status dashboard from nodetool status

nodetool status | arb -p scylla

# sentry

error/event dashboard from sentry-cli event listings

sentry-cli events list | arb -p sentry

# sidekiq

job throughput by class, failures, and slow-job durations

sidekiqmon --json | arb -p sidekiq

# skopeo

copy progress dashboard from live skopeo copy output

skopeo copy docker://src docker://dst | arb -p skopeo

# smartctl

SMART attribute health dashboard from smartctl -A output

smartctl -A /dev/sda | arb -p smartctl

# spinnaker

pipeline execution status dashboard from spin CLI execution JSON

spin pipeline execution list --application foo | arb -p spinnaker

# sqlite

query-result dashboard from pipe-separated sqlite3 output

sqlite3 app.db 'SELECT level,msg FROM logs' | arb -p sqlite

# ss

TCP socket connection states and recv-queue backlog

ss -tan | arb -p ss

# statsd

metric-type and top-metric tally plus live stream from the statsd line protocol

nc -lku 8125 | arb -p statsd

# stern

per-container log volume + error count from live multi-pod tail

stern . | arb -p stern

# supervisor

process states, uptime, and event stream

supervisorctl status --json | arb -p supervisor

# systemd

journal priority breakdown from journalctl JSON

journalctl -o json | arb -p systemd

# table

columnar view of whitespace-delimited input (ps aux, ls -l, df, …).

ps aux | arb -p table

# tcpdump

live packet dashboard (protocol mix, packet rate, raw capture)

tcpdump -nn -l | arb -p tcpdump

# teamcity

build status/state dashboard from TeamCity REST builds JSON

curl -s "$TC/app/rest/builds" -H 'Accept: application/json' | jq -c '.build[]' | arb -p teamcity

# tekton

pipelinerun status dashboard from tkn pipelinerun list

tkn pipelinerun list | arb -p tekton

# telegraf

InfluxDB line-protocol dashboard from telegraf --test

telegraf --test | arb -p telegraf

# tempo

trace-backend log dashboard (level tally + error count) from JSON logs

tempo 2>&1 | arb -p tempo

# terraform

plan change types, resource providers, and apply durations

terraform plan -json | arb -p terraform

# tidb

cluster component status/role dashboard from tiup cluster display

tiup cluster display mycluster | arb -p tidb

# timescaledb

hypertable chunk & compression dashboard from timescaledb_information.chunks

psql --csv -c "SELECT hypertable_name, is_compressed, chunk_name FROM timescaledb_information.chunks" | arb -p timescaledb

# tomcat

HTTP status/request dashboard from Tomcat access logs

tail -f logs/localhost_access_log.txt | arb -p tomcat

# top

process stats (feed `ps aux`): total %CPU gauge + live process list.

ps aux | arb -p top

# traefik

reverse-proxy dashboard from Traefik JSON access logs

tail -f access.log | arb -p traefik

# tshark

protocol mix and top talkers from default packet output

tshark -r cap.pcap | arb -p tshark

# uwsgi

worker status and request dashboard from JSON stats output

uwsgi --connect-and-read /tmp/stats.sock | arb -p uwsgi

# vagrant

VM state and provider dashboard from vagrant global-status

vagrant global-status | arb -p vagrant

# varnish

cache hit/miss distribution and slow backend responses

varnishncsa -F '%{VCL_Log:hit}x %{Varnish:time_firstbyte}x %U' | arb -p varnish

# vault

audit-log request paths, latency, and error rate

vault audit -format=json | arb -p vault

# velero

backup status dashboard from velero backup get

velero backup get | arb -p velero

# victoriametrics

TSDB self-metrics dashboard from the /metrics exposition endpoint

curl -s http://localhost:8428/metrics | arb -p victoriametrics

# vmstat

CPU idle %, free memory, and run-queue length distribution

vmstat 1 | arb -p vmstat

# vnstat

live rx/tx network rate dashboard from traffic sampling

vnstat -tr | arb -p vnstat

# vultr

instance status/region dashboard from vultr-cli instance list

vultr-cli instance list | arb -p vultr

# woodpecker

pipeline status/branch dashboard from woodpecker pipeline list output

woodpecker pipeline ls owner/repo | arb -p woodpecker

# zabbix

problem/alert dashboard from exported Zabbix problem JSON

zabbix_get -s host -k problems.json | arb -p zabbix

# zfs

dataset dashboard from zfs list (pool tally, count, dataset names)

zfs list | arb -p zfs

# zipkin

span dashboard from Zipkin JSON spans (name, kind, duration)

curl -s localhost:9411/api/v2/trace/<id> | jq -c '.[]' | arb -p zipkin

More