Use live tail to view logs as they come into VMware Aria Operations for Logs (SaaS).

Procedure

  1. Expand the main menu and click Live Tail.
    Tip: To use live tail from the Explore Logs page, enter a query and then click Live Tail to stream logs corresponding to your query.
  2. Type a query and press Enter. You can use multiple keywords and filters. You can also:
    • Use a saved query by clicking Open Saved Query.
    • Use a favorite query by clicking the star icon next to the search text box.
    • Select one or more partitions next to the search text box to stream logs from the partition. You can select multiple indexed partitions or non-indexed partitions, but not both at the same time.
    For more information about log search, see Search for and Filter Log Events.
    Note: Because live tail does not support extracted fields:
    • You cannot enter a query with extracted fields.
    • When you select a saved or favorite query, the queries with extracted fields are hidden.
    The logs corresponding to your query start streaming in real time.
  3. Click Stop Live Tail to stop streaming the logs and Start Live Tail to continue streaming the logs.
  4. (Optional) To update the live tail session and stream logs based on a different criteria, do either of the following:
    • Type a query and press Enter.
    • Type a query, click Stop Live Tail, and then click Start Live Tail.
    • Select a saved or favorite query.