Skip to main content
Live tail streams telemetry to your browser as it arrives, over a WebSocket. It is the closest thing to tail -f across your whole estate.
Before you start. You need telemetry currently arriving. Live tail shows what is happening now — a quiet service produces an empty stream, which is correct rather than broken.

​
What it is for

Watching a deploy

Errors appear as they happen rather than after you decide to look.

Reproducing a bug

Trigger the behaviour and watch the records land, with no time-range guessing.

Confirming a new integration

The fastest way to see that a newly-pointed exporter is actually sending.

Watching an incident develop

A rate of arrival is visible in a way a refreshed table is not.

​
Signals

Live tail carries logs, metrics and traces — one signal per stream. Choose the signal, then open the stream.

​
What it is not

Live tail is not a search over your history. It shows records arriving from the moment you connect. Nothing that arrived before you opened it will appear, and disconnecting loses the buffer.For anything that already happened, use Searching logs — it has field filters, booleans, wildcards and numeric comparisons, none of which apply here.
Do not use live tail to decide that nothing is being sent. A stream that stays empty for a minute is consistent with a broken exporter and with a service that simply had no traffic.To establish whether ingest is working, send something you can recognise and look for it — Verify your data arrived covers the difference between accepted and queryable, which is the distinction that actually matters here.

​
Volume

On a busy organization, an unfiltered stream produces more than anyone can read. Narrow to a service or a severity before opening it — live tail is most useful when it is nearly quiet, so that the thing you are waiting for stands out.
The stream is scoped to your organization, resolved from your session. There is no parameter that changes which organization you are watching — a value that must equal your session’s is a value with no reason to be sent.

​
Access

Live tail is a read surface, so any role that can read telemetry can use it — including Viewer. See Roles and permissions.

​
Next

Searching logs

The query syntax for everything that already happened.

Verify your data arrived

Accepted versus queryable, and the three places to look.

Log patterns

Grouping millions of lines into the handful of shapes they take.