Search AWS SQS Messages

Tarmac receives AWS SQS messages into a local cache so you can run full-text searches, combine filters, and inspect results without touching the live queue again.

All searching and filtering runs against that cache. It costs nothing against SQS, has no visibility side effects, and works offline. Fetch generously, then slice locally.

Full-text search

The search box (⌘/Ctrl + F) matches message IDs, attribute values, and body text. Anything that is not a letter or a digit splits what you type into separate terms, and a message matches only when every term does.

Terms match from the start of a word. ord 123 finds a body containing "orderId": "12345", and NOT_PROCESSED searches for NOT and PROCESSED. The same rule means 422 does not find ORD422; search for ord422 instead. Unicode terms work, and AND, OR, NOT, and NEAR are ordinary text here.

Facet filters

Tarmac builds facets from cached message attributes and JSON bodies:

• Attributes. Each SQS system attribute and message attribute becomes a facet.
• Body fields. JSON fields become facets, labeled by dotted path (order.status: failed). A field holding a list contributes its first 20 values.

Open the Facet Filters panel to see facet groups with live counts. Selections within a group are OR'd. Selections across groups are AND'd. So status: failed plus (region: us-east-1 or region: us-west-2) reads exactly the way you would expect. Active facets appear as chips you can remove above the message list.

Each key offers its 100 most common values, and a queue offers 200 keys. The panel tells you when a key or the queue has more than it is showing. To find one specific value — a request id, say — search the message list instead.

Date range and sorting

The From and To inputs filter on the message's SQS sent timestamp. Combine them with search and facets to isolate an incident window. The list sorts by sent date, ascending or descending, and pages 100 messages at a time with a Load older messages control that shows "Showing X of Y".

The message inspector

Click a row, or press Enter on a selection, to open the inspector panel. Tabs adapt to the message:

• Body. Pretty-printed JSON with syntax highlighting and line numbers. JSON stringified inside JSON is unwrapped, so a payload buried in an SNS envelope still reads as clean JSON.
• S3. Appears when an offloaded payload has been retrieved, and shows the fetched S3 object. See S3 Payloads.
• Attributes. Message attributes, with binary values shown base64-encoded.
• Envelope. Appears for SNS-wrapped messages, with topic ARN, subject, timestamp, and SNS message attributes.
• System. Sent time, first receive time, receive count, sender, and FIFO group and deduplication IDs.
• Raw. The message as raw JSON.

The message ID and the Body, S3, and Raw views each have a copy button. Rows also offer a one-click copy of the message body, which prefers the retrieved S3 payload when there is one. Copy gives you the original payload. Nested stringified JSON stays stringified, so what you paste is what the producer sent.

Per-queue workspace memory

Tarmac remembers your workspace per queue: search text, facet selections, date range, selected message, and panel sizes. It restores them when you return to that queue. The workspace mode is not remembered. Selecting a queue always opens Inspect.