Live Tailing Parsed Logs in Logz.io

Last year we introduced Live Tail — the ability to see a live feed of all the logs in your system, in real time, within Kibana.

This ability to see a live stream of logs as they are being outputted from the different processes in a monitored environment was a greatly requested feature, and since being introduced we have received some excellent feedback from users that has allowed us to improve the basic functionality of Live Tail. 

We are now happy to inform our users that we have added the ability to see a live stream of parsed data as well. Up until now, users could only see a live tail of the raw data output. Now, they can choose whether to see parsed log messages instead.

Let’s take a closer look.

Live Tail is an easy-to-use and intuitive tool. Opening the Live Tail page in Logz.io, all users have to do to start seeing their data streamed in real time is hit the Play button.  Logz.io then opens up a connection and begins tailing all the logs being shipped into Logz.io in their raw format. 

To use the new functionality and switch to a parsed view, all you have to do is select Parsed data on the left side of the menu bar. A new area is displayed under the menu bar, showing two default fields – the @timestamp and message fields, as well as a + button.

Hitting the Play button now, your logs will begin to stream parsed into these two default fields.

Depending on the log type, you might want to get a more granular look into some of the log data by seeing additional fields.  To do this, simply click the + button.

A dialog pops up that allows you to add columns to the Live Tail view.

Selecting a specific log type and any corresponding field. Clicking Apply adds a new column to the Live Tail view. A new connection is established with each applied change so there’s no need to click Play again.

In the example below, I’ve added the client_ip field to haproxy logs:

You can add as many columns as you like, switch the order in which these columns are displayed and remove columns.

Of course, all of Live Tail’s features are available for parsed data. You can use filtering, searching, highlighting, scrolling and clearing on your parsed data just as you would use these functions on unparsed data.

As always, we’d love to get your feedback. So if you have any ideas on how to improve Live Tail, please let us know at: info@logz.io. 

We’ve got some additional goodies on the way, so stay tuned for news and updates!