Log Analysis: Identify Certificates Issued by step-ca

I love Victoria Logs. Being able to quickly find logs from anywhere in the environment by itself is invaluable. Beyond that, though there are so many other cool things I can do with it. Here's one fun example: finding all of the certificates step-ca has issued in the last 30 days:

curl -sN https://logs.pyrocufflink.blue/select/logsql/query \
    -b ${XDG_RUNTIME_DIR}/curl.cookiejar \
    -d query='
_time:30d kubernetes.namespace_name: step-ca
| unpack_json
| provisioner: acme
| fields certificate
' \
    | jq -r .certificate \
    | while IFS= read -r cert; do \
        printf '%s' "${cert}" \
        | base64 -d \
        | openssl x509 -noout -text
    done \
    | grep DNS: \
    | sort -u \
;

This works because step-ca writes its logs as JSON documents, and includes the whole certificate it issued in the log record.

This particular query is useful to me because I am currently int he process of migrating from step-ca to OpenBao, and I wanted to identify all of the certificate automations that need to be moved.