In online O&M scenarios, you may need to monitor logs in real time and extract critical information from the latest logs for troubleshooting. You can use the LiveTail feature to monitor and filter logs in real time without the need to manage the corresponding servers.
Prerequisites
Logs are collected by using Logtail. For more information, see Use Logtail to collect logs.
If you use a Logtail plug-in to process text logs or collect the stdout and stderr of a container, you must add the aggregators configuration to the Logtail plug-in configuration. For more information, see Overview.
Background information
In online O&M scenarios, you may need to monitor logs in a queue in real time and extract critical information from the latest logs for troubleshooting. If you use a traditional O&M method, you must run the tail -f command on your server to query logs in log files. If you want to narrow the scope of the command output, you must run the grep or grep -v command to filter logs by keyword. To reduce O&M workloads, Simple Log Service provides the LiveTail feature in the Simple Log Service console. You can use the feature to monitor and analyze logs in real time.
Benefits
You can monitor logs in real time and filter logs by keyword.
You can configure indexes for collected logs based on collection configurations.
You can use delimiters to split log fields into words. This way, you can query contextual logs that contain the words.
You can locate a log file by log and monitor the logs in real time without the need to log on to a server.
Procedure
The LiveTail feature is supported only for log data that is collected by Logtail.
Log on to the Simple Log Service console.
In the Projects section, click the project that you want to manage.
In the left-side navigation pane, click Log Storage. In the Logstores list, click the Logstore that you want to manage.
On the Raw Data tab, find the log that you want to manage, and click the icon.
In the LiveTail section, view the results.
After LiveTail is enabled, logs that are collected by Logtail are displayed in the LiveTail section in real time. By default, the latest log is displayed in the lower part of the LiveTail section. The scroll bar is also displayed in the lower part. Up to 1,000 logs can be displayed in the LiveTail section. If more than 1,000 logs are collected, the LiveTail section is automatically refreshed to display the latest 1,000 logs.
More operations
Operation | Description |
Highlight strings | You can enter one or more strings in the Highlight field. After the configuration is complete, the specified strings are highlighted in the LiveTail section. |
Filter logs by string | You can enter one or more strings in the Filter By field. After the configuration is complete, only logs that contain the specified strings are displayed in the LiveTail section. |
Filter logs by field | You can select one or more fields from the Filter by Field drop-down list. After the configuration is complete, logs that contain the specified fields are not displayed in the LiveTail section. |
Disable LiveTail | You can click Stop to disable LiveTail. After you disable LiveTail, logs in the LiveTail section are no longer updated. You can analyze and troubleshoot the errors that are identified when you monitor logs. |