pgbadger

Assuming your local machine is on the wireguard network...

On haumea, run:

socat -u SYSTEM:'journalctl --output=short-iso -u postgresql | pv --cursor --name "Pre-compression" | zstd -9 | pv --cursor --name "Post-compression"' TCP4-LISTEN:10050,so-bindtodevice=wg0,reuseaddr

Or, for the 5h of recent logs:

socat -u SYSTEM:"journalctl --since -5h --output=short-iso -u postgresql | pv --cursor --name Pre-compression | zstd -9 | pv --cursor --name Post-compression" TCP4-LISTEN:10050,so-bindtodevice=wg0,reuseaddr

Or, for logs since a certain moment (note the escaping):

socat -u SYSTEM:'journalctl --output=short-iso -u postgresql --since "2022-01-17\\ 16:23:04" | pv --cursor --name "Pre-compression" | zstd -9 | pv --cursor --name "Post-compression"' TCP4-LISTEN:10050,so-bindtodevice=wg0,reuseaddr

On your local machine, run:

nix run nixpkgs#pgbadger -- --journalctl 'xfer() { nc -N 10.254.1.9 10050 < /dev/null | zstd -d; }; xfer' --prefix "%t\+\d+ .*[%p]: user=%u,db=%d,app=%a,client=%h "

Note the bizarre --journalctl argument is to deal with pgbadger passing --output=short-iso to the command. If it isn't working correctly, try removing the xfer() { ... }; xfer wrapper and see what arguments it is passing.