Live tail

Live tail subscribes to your search query and pushes new matching events into the result list in real time. Use it when something is happening right now that you want to watch unfold.

How to start a tail

1. Write a query in the search bar (or use one of the buttons in the empty state).
2. Click the ↗ LIVE button in the toolbar.
3. The status pill in the breadcrumb flips to OPENING then LIVE. The button label changes to STOP.
4. New events matching your query start arriving in the result list, newest at the top.

You should see a small 0 / 500 counter in the pane header. The first number is the count of events buffered so far; the second is the maximum buffer size.

How to stop

Click STOP or hit the BACK button on your browser. The stream closes immediately and the LIVE badge clears.

Stopping does not lose the buffer. You can read what was captured. If you click LIVE again, the buffer resets: each new tail session starts fresh from "now" and does not replay events from before the click.

Why each session starts fresh

Live tail is a forward-only stream. The server only sends events with a timestamp strictly later than the moment you started the session. This is intentional: you opened the tail to watch what is happening, not to replay backlog.

If you need the recent past too, run a one-shot search first (with the time-range picker) to see history, then click LIVE to watch new events arrive.

Buffer cap of 500

The visible event list is capped at the last 500 events. Once you hit the cap, older events drop off the bottom as new ones arrive at the top. A small Buffer at 500 events. Older events trimmed as new ones arrive. notice appears under the last row.

This is not a server-side cap. The server keeps sending; your browser just stops growing the list. For long-running tails on busy servers, write something narrower (severity:warn instead of severity:info) or use a server-side group-by query.

Tier requirements

Live tail is available on Logs Pro plans and higher. Hobby and Free plans get an error panel when they click LIVE: "live tail requires the Logs Pro plan or higher". The dashboard surfaces your current tier inline so you know what to upgrade to.

Session cap

Each API token / user can hold at most 3 concurrent live-tail sessions on the same API instance. Opening a 4th tail returns an error: "you already have the maximum live-tail sessions open for this account. Close another tab and retry."

The cap is per-token, not per-user, so closing a tail tab frees a slot. The server detects closed connections within ~15 seconds.

Idle timeout

If no matching events arrive for 5 minutes, the server closes the tail with the reason idle_timeout. The dashboard shows a small "Live tail closed after 5 minutes of no new events. Click LIVE to reopen." line. This protects the server from accumulating zombie tail connections.

For long-running watches, write a broader query (one that gets at least one event per few minutes) so the heartbeat keeps the session warm.

What happens if you edit the query mid-tail

Typing in the search bar while a tail is running automatically stops the tail. The next time you click LIVE, the new query is used. This avoids the confusing situation where the server is filtering against an old query while your visible text says something different.