Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Flogs%2Flivetail.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Flogs%2Flivetail.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# LiveTail

LiveTail is a real-time pre-index log stream. Use it to watch logs as they arrive, without waiting for ingestion to finish.

LiveTail is most useful for:

* Tailing logs from a specific application or subsystem during a deployment or incident.
* Confirming that a service is emitting logs at all.
* Spotting noisy or error-prone log patterns in real time.

## Open LiveTail[​](#open-livetail "Direct link to Open LiveTail")

Open LiveTail in one of two ways:

* Navigate to **LiveTail** in the Coralogix main menu.
* From the Explore logs results, open the value menu on an **Application** or **Subsystem** field value and select **Live tail**. LiveTail opens in a new tab pre-filtered to that value.

You need the **LiveTail read** permission to access the screen.

## Start streaming[​](#start-streaming "Direct link to Start streaming")

1. Use the **Applications** and **Subsystems** multi-selects in the toolbar to narrow the stream. Both default to "All Applications" / "All Subsystems".
2. Select **Start** (or press **Enter** in the search field) to begin streaming.
3. The button toggles to **Pause** while logs stream. Select **Pause** — or press **Ctrl/Cmd + C** — to stop the stream without leaving the screen.
4. Select **Clear** to wipe the log buffer.

LiveTail keeps up to 700 logs in the on-screen buffer; older entries roll off as new ones arrive.

## Filter the stream[​](#filter-the-stream "Direct link to Filter the stream")

Use the search field above the log stream to filter what you see in real time.

The field supports:

* **Plain text**: matches anywhere in the log row.
* **Regex**: write a pattern directly; matches highlight inline.
* **Grep-style chains**: chain expressions with `| grep …` to narrow successive matches.

Supported `grep` flags:

| Flag | Meaning                                                           |
| ---- | ----------------------------------------------------------------- |
| `-i` | Case-insensitive match                                            |
| `-v` | Invert match (show rows that do **not** match)                    |
| `-o` | Highlight each occurrence in the row                              |
| `-F` | Fixed-string match (treat the pattern as literal text, not regex) |

Matches highlight across the log message text **and** the row's metadata fields — application, subsystem, severity, and host (`computerName`).

Maximum pattern length is 500 characters.

### Example[​](#example "Direct link to Example")

The following filter chains a case-insensitive regex, an exact text match, and another case-insensitive regex:

```
| grep -i opentelemetry\.io | grep "schemas" | grep -i TimE
```

First, a case-insensitive regex search for `opentelemetry.io` runs. The results are filtered to rows containing the exact string `schemas`. Finally, a case-insensitive match for `TimE` is applied. All matches highlight in the stream.

## Customize the view[​](#customize-the-view "Direct link to Customize the view")

* **Choose fields**: for structured JSON logs, open the field picker to limit which leaf fields appear in each row. The picker shows leaf fields of type string, number, or boolean from the log schema.
* **Prettify** / **Unprettify**: toggle between formatted-object rendering and compact text. Highlighted search terms stay visible in either mode. Rendering respects the active dark or light theme.

## Severity stats[​](#severity-stats "Direct link to Severity stats")

A strip across the top of LiveTail shows running counts per severity (Critical, Error, Warning, Info, Verbose, Debug) with a sparkline for each. Use it to spot a spike in errors or warnings as logs stream in.

## Share a LiveTail view[​](#share-a-livetail-view "Direct link to Share a LiveTail view")

LiveTail keeps the current filters in the URL via `apps`, `subsystems`, and `grep` query parameters. Copy the URL to share or bookmark a specific stream — reloading the URL restores the same filters.