LiveTail

LiveTail is a real-time pre-index log stream. Use it to watch logs as they arrive, without waiting for ingestion to finish.

LiveTail is most useful for:

• Tailing logs from a specific application or subsystem during a deployment or incident.
• Confirming that a service is emitting logs at all.
• Spotting noisy or error-prone log patterns in real time.

Open LiveTail

Open LiveTail in one of two ways:

• Navigate to LiveTail in the Coralogix main menu.
• From the Explore logs results, open the value menu on an Application or Subsystem field value and select Live tail. LiveTail opens in a new tab pre-filtered to that value.

You need the LiveTail read permission to access the screen.

Start streaming

1. Use the Applications and Subsystems multi-selects in the toolbar to narrow the stream. Both default to "All Applications" / "All Subsystems".
2. Select Start (or press Enter in the search field) to begin streaming.
3. The button toggles to Pause while logs stream. Select Pause — or press Ctrl/Cmd + C — to stop the stream without leaving the screen.
4. Select Clear to wipe the log buffer.

LiveTail keeps up to 700 logs in the on-screen buffer; older entries roll off as new ones arrive.

Filter the stream

Use the search field above the log stream to filter what you see in real time.

The field supports:

• Plain text: matches anywhere in the log row.
• Regex: write a pattern directly; matches highlight inline.
• Grep-style chains: chain expressions with | grep … to narrow successive matches.

Supported grep flags:

Flag	Meaning
-i	Case-insensitive match
-v	Invert match (show rows that do not match)
-o	Highlight each occurrence in the row
-F	Fixed-string match (treat the pattern as literal text, not regex)

Matches highlight across the log message text and the row's metadata fields — application, subsystem, severity, and host (computerName).

Maximum pattern length is 500 characters.

Example

The following filter chains a case-insensitive regex, an exact text match, and another case-insensitive regex:

| grep -i opentelemetry\.io | grep "schemas" | grep -i TimE

First, a case-insensitive regex search for opentelemetry.io runs. The results are filtered to rows containing the exact string schemas. Finally, a case-insensitive match for TimE is applied. All matches highlight in the stream.

Customize the view

• Choose fields: for structured JSON logs, open the field picker to limit which leaf fields appear in each row. The picker shows leaf fields of type string, number, or boolean from the log schema.
• Prettify / Unprettify: toggle between formatted-object rendering and compact text. Highlighted search terms stay visible in either mode. Rendering respects the active dark or light theme.

Severity stats

A strip across the top of LiveTail shows running counts per severity (Critical, Error, Warning, Info, Verbose, Debug) with a sparkline for each. Use it to spot a spike in errors or warnings as logs stream in.

Share a LiveTail view

LiveTail keeps the current filters in the URL via apps, subsystems, and grep query parameters. Copy the URL to share or bookmark a specific stream — reloading the URL restores the same filters.