View the logs for any resource directly from its drilldown panel in Infrastructure Explorer, and stream new log lines as they arrive with LiveTail, without leaving the resource you are investigating.

The **Logs** tab in a resource's drilldown panel shows log data for that resource. Use **Query** mode to analyze the logs already collected, or switch to **LiveTail** mode to watch incoming logs stream in real time, automatically scoped to the selected resource.

## What you need

- Access to **Infrastructure**, then **Infrastructure Explorer**.
- A resource that ships logs to Coralogix.
- The [`LIVETAIL:READ`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list/index.md) permission to use LiveTail mode.

## Open the Logs tab

1. Select **Infrastructure**, then **Infrastructure Explorer**.
1. Select a resource to open its drill-down panel.
1. Open the **Logs** tab.

The Logs tab opens in **Query** mode and shows the logs collected for the resource. Use the **Query** and **LiveTail** toggle at the top of the tab to switch modes.

## Analyze collected logs in Query mode

**Query** mode shows the logs already collected for the resource, fetched when you open the panel. Use it to review recent activity and analyze patterns.

In Query mode you can:

- Review the **Logs grouped by severity** chart to see log volume over the selected time range.
- Filter the displayed logs by severity.
- Scan the log table, which includes the timestamp, text, application, and subsystem for each entry.

Query mode shows a snapshot. To see new lines, refresh the panel or switch to LiveTail mode.

## Stream logs in real time with LiveTail

LiveTail streams incoming log lines for the resource as they arrive, so you can watch live activity during an investigation.

1. In the Logs tab, select **LiveTail**.
1. Select **Play** to start streaming. Log lines that match the selected resource appear in the panel as they arrive.
1. Select **Pause** to stop the stream and inspect the lines collected so far.
1. Select **Clear** to remove the streamed lines from the display and start fresh.

LiveTail scopes the stream to the selected resource automatically. The query bar shows the applied query.

## Refine and format the log stream

While streaming, narrow and format the output:

- **Refine the query:** Add `grep`, text, or regular expression clauses in the query bar to filter the stream further.
- **Show specific fields:** For structured JSON logs, select **Choose fields** to display only the fields you need.
- **Format the output:** Select **Prettify** to structure each log line as a formatted object, or turn it off to show raw lines.

To continue your investigation in a full logs view, select **Explore Logs** to open the logs in Logs Explorer.

## Limitations

- LiveTail mode streams application logs only. Kubernetes events are not streamed in LiveTail; view them in the **K8s Events** section of the drilldown panel.
- LiveTail supports resource types that expose identifying log fields, such as pods, nodes, namespaces, clusters, deployments, and containers.

## Related resources

- [Explore infra resources](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/explore-infra/index.md)
- [View lifecycle events](https://coralogix.com/docs/user-guides/infrastructure/infrastructure-explorer/lifecycle-events/index.md)
- [LiveTail](https://coralogix.com/docs/user-guides/data_exploration/logs/livetail/index.md)