docs: how to see your logs in Kibana

README.md

@@ -7,6 +7,7 @@ Express 5 + TypeScript backend, generated from `nholtware/service-template-expre
 - `GET /healthz` liveness, always 200 once listening
 - `GET /readyz` readiness: Postgres `SELECT 1` and Redis `PING` for whichever of `DATABASE_URL` / `REDIS_URL` are set; 503 + JSON reason otherwise
 - `GET /` service name, version (git sha), pod, a `service_info` row, Redis hit counter
+- `GET /log-demo?msg=...` logs `{ demo: true, text }` with message `log-demo` (logging-pipeline demo; delete when you don't need it)
 
 ## Local dev
 
@@ -20,6 +21,20 @@ Env is validated at boot (`src/lib/config.ts`): `PORT`, `SERVICE_NAME` (required
 Migrations: SQL files in `migrations/`, applied with `npm run migrate`.
 Logs: one JSON object per line on stdout (`level,time,msg,service,version`, plus `req.*`/`res.statusCode`/`responseTime` per request).
 
+## Seeing your logs
+
+Every container's stdout is shipped to Elasticsearch by Fluent Bit; nothing to configure per service.
+
+1. Open Kibana: http://kibana.192.168.1.83.nip.io, user `elastic`, password from
+   `kubectl get secret -n logging logging-es-elastic-user -o jsonpath='{.data.elastic}' | base64 -d`.
+2. **Discover**, data view `kube-*` (the default).
+3. Query with KQL, e.g. `service:"hello-svc" and demo:true`, or `service:"hello-svc" and level:"error"`.
+
+Any field you pass to the logger becomes a queryable field:
+`req.log.info({ orderId }, "order placed")` → KQL `orderId:123`. The message string always
+overrides a `msg` key in the object, so don't name a field `msg`. Lines are searchable within a few seconds;
+retention is 14 days.
+
 ## Using this template
 
 1. **Generate** a repo from this template in Forgejo (public). `hello-svc` is substituted into `package.json`, this README, `.env.example`, the CI workflow, and the first migration.