Use live tail to view logs as they come into VMware Aria Operations for Logs (SaaS).
Procedure
- Expand the main menu and click Live Tail.
Tip: To use live tail from the Explore Logs page, enter a query and then click Live Tail to stream logs corresponding to your query.
- Type a query and press Enter. You can use multiple keywords and filters. You can also:
- Use a saved query by clicking Open Saved Query.
- Use a favorite query by clicking the star icon next to the search text box.
- Select one or more partitions next to the search text box to stream logs from the partition. You can select multiple indexed partitions or non-indexed partitions, but not both at the same time.
For more information about log search, see Search for and Filter Log Events.Note: Because live tail does not support extracted fields:- You cannot enter a query with extracted fields.
- When you select a saved or favorite query, the queries with extracted fields are hidden.
The logs corresponding to your query start streaming in real time. - Click Stop Live Tail to stop streaming the logs and Start Live Tail to continue streaming the logs.
- (Optional) To update the live tail session and stream logs based on a different criteria, do either of the following:
- Type a query and press Enter.
- Type a query, click Stop Live Tail, and then click Start Live Tail.
- Select a saved or favorite query.