Live tail

Streaming search over the write path, under a second behind.

Live tail runs a filter against events as they are written, before they are committed to storage. It is tail -f for a production firehose, with a where clause.

api-gateway-prod

live

--:--:--.---infoapi-gatewayGET /v1/session 200 in 31ms

--:--:--.---warnpaymentsupstream retry 1/3 · stripe timeout

--:--:--.---errorcheckoutpool exhausted: 40/40 connections

--:--:--.---infoauthtoken refreshed org_8f21c4

--:--:--.---debugotel-collectorflushed 4,096 spans in 12ms

--:--:--.---infosearchreindex shard 7 complete

--:--:--.---errorpaymentscharge.failed · insufficient_funds

--:--:--.---infoedgecache HIT ratio 0.94 · fra1

Using it

Any where clause works

read top to bottom

1['api-gateway-prod']
2| where service == "checkout" and status >= 500
3| project _time, route, latency, message

Tails cannot aggregate

There is no end of input to summarize over, so summarize, order by and join are rejected in a tail. Filter and project; poll a normal query for aggregates.

From the terminal

CLI

logstreem tail api-gateway-prod --where 'status >= 500' --follow

# Pipe it anywhere
logstreem tail api-gateway-prod --json | jq 'select(.latency > 1000)'

Limits

Limit	Value
Lag behind write	Under 800 ms at p95
Concurrent tails per org	20
Idle timeout	30 minutes
Matched events per second	10,000, then sampled with a visible notice

PreviousExplore NextSaved queries