> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Live tail

> Stream logs, metrics and traces as they arrive, what live tail is genuinely good for, and why it is not a search over your history.

Live tail streams telemetry to your browser as it arrives, over a WebSocket. It
is the closest thing to `tail -f` across your whole estate.

<Info>
  **Before you start.** You need telemetry currently arriving. Live tail shows
  what is happening now — a quiet service produces an empty stream, which is
  correct rather than broken.
</Info>

## What it is for

<CardGroup cols={2}>
  <Card title="Watching a deploy" icon="rocket">
    Errors appear as they happen rather than after you decide to look.
  </Card>

  <Card title="Reproducing a bug" icon="bug">
    Trigger the behaviour and watch the records land, with no time-range
    guessing.
  </Card>

  <Card title="Confirming a new integration" icon="plug">
    The fastest way to see that a newly-pointed exporter is actually sending.
  </Card>

  <Card title="Watching an incident develop" icon="fire">
    A rate of arrival is visible in a way a refreshed table is not.
  </Card>
</CardGroup>

## Signals

Live tail carries **logs**, **metrics** and **traces** — one signal per stream.
Choose the signal, then open the stream.

## What it is not

<Warning>
  **Live tail is not a search over your history.** It shows records arriving
  from the moment you connect. Nothing that arrived before you opened it will
  appear, and disconnecting loses the buffer.

  For anything that already happened, use
  [Searching logs](/guides/logs/search) — it has field filters, booleans,
  wildcards and numeric comparisons, none of which apply here.
</Warning>

<Warning>
  **Do not use live tail to decide that nothing is being sent.** A stream that
  stays empty for a minute is consistent with a broken exporter *and* with a
  service that simply had no traffic.

  To establish whether ingest is working, send something you can recognise and
  look for it — [Verify your data arrived](/get-started/verify-data) covers the
  difference between accepted and queryable, which is the distinction that
  actually matters here.
</Warning>

## Volume

On a busy organization, an unfiltered stream produces more than anyone can
read. Narrow to a service or a severity before opening it — live tail is most
useful when it is nearly quiet, so that the thing you are waiting for stands
out.

<Note>
  **The stream is scoped to your organization**, resolved from your session.
  There is no parameter that changes which organization you are watching — a
  value that must equal your session's is a value with no reason to be sent.
</Note>

## Access

Live tail is a read surface, so any role that can read telemetry can use it —
including **Viewer**. See [Roles and permissions](/concepts/roles).

## Next

<CardGroup cols={3}>
  <Card title="Searching logs" icon="magnifying-glass" href="/guides/logs/search">
    The query syntax for everything that already happened.
  </Card>

  <Card title="Verify your data arrived" icon="circle-check" href="/get-started/verify-data">
    Accepted versus queryable, and the three places to look.
  </Card>

  <Card title="Log patterns" icon="layer-group" href="/guides/logs/patterns">
    Grouping millions of lines into the handful of shapes they take.
  </Card>
</CardGroup>