I just implemented zsh tab-completion functionality for sysdig:

https://raw.githubusercontent.com/dkogan/sysdig/master/scripts/completions/zsh/_sysdig

The patch was merged to sysdig upstream.

It's fairly nice, and makes sysdig easier to use for those who don't yet have all the knobs memorized, such as myself. I complete on

  • commandline options
  • commandline option arguments
  • chisel names
  • chisel arguments
  • filter field names

Some of those are hard-coded in the completion script, and some are reported by the sysdig executable itself. Having written this I'm now acutely aware of missing similar functionality in tcpdump and perf. Both of those have some tab completion, but do not complete on event types. If they did, writing things like tcpdump filters would be much easier. That's a good thing to add at some point.

Another interesting discovery is that it is apparently normal for zsh completion scripts to live in the zsh repository, not in the repository of the thing being completed. So in this case I apparently went against to grain by contributing my script to sysdig instead of zsh. This feels right, though. But if I make those additions to tcpdump and/or perf completions, those will go to the zsh people.