Skip to Content
DocumentationCLICommandslogs

kubetail logs

Fetch logs for a specific container or a set of workload containers.
 
Examples:
 
  - Sources
 
    # Tail 'web-abc123' pod in 'default' namespace
    kubetail logs web-abc123
 
    # Tail 'web' deployment in the 'default' namespace
    kubetail logs deployments/web
 
    # Tail all the deployments in the 'default' namespace
    kubetail logs deployments/*
 
    # Tail the 'container1' container in the 'web' deployment
    kubetail deployments/web/container1
 
    # Tail all the containers in the 'web' deployment
    kubtail logs deployments/web/*
 
    # Tail 'web-abc123' pod in 'frontend' namespace
    kubetail logs frontend:web-abc123
 
    # Tail 'web' deployment in the 'frontend' namespace
    kubetail logs frontend:deployments/web
 
    # Tail multiple sources
    kubetail logs <source1> <source2>
 
  - Tail/Head
 
    # Return last 10 records from the 'nginx' pod (default container)
    kubetail logs nginx
 
    # Return last 100 records
    kubetail logs nginx --tail=100 
 
    # Return first 10 records
    kubetail logs nginx --head
 
    # Return first 100 records
    kubetail logs nginx --head=100 
 
    # Stream new records
    kubetail logs nginx --follow
 
    # Return last 10 records and stream new ones
    kubetail logs nginx --tail --follow
 
    # Return all records
    kubetail logs nginx --all
 
    # Return all records and stream new ones
    kubetail logs nginx --all --follow
 
  - Time filters
 
    # Return first 10 records starting from 30 minutes ago
    kubetail logs nginx --since PT30M
 
    # Return last 10 records leading up to 30 minutes ago
    kubetail logs nginx --until PT30M
 
    # Return all records starting from 30 minutes ago
    kubetail logs nginx --since PT30M --all
 
    # Return first 10 records between two exact timestamps
    kubetail logs nginx --since 2006-01-02T15:04:05Z07:00 --until 2007-01-02T15:04:05Z07:00
 
    # Return last 10 records between two exact timestamps
    kubetail logs nginx --since 2006-01-02T15:04:05Z07:00 --until 2007-01-02T15:04:05Z07:00 --tail
 
    # Return all records between two exact timestamps
    kubetail logs nginx --since 2006-01-02T15:04:05Z07:00 --until 2007-01-02T15:04:05Z07:00 --all
 
  - Grep filter (requires --force)
 
    # Return last 10 records from the 'nginx' pod that match "GET /about"
    kubetail logs nginx --grep "GET /about" --force
 
    # Return first 10 records
    kubetail logs nginx --grep "GET /about" --head --force
 
    # Return last 10 records that match "GET /about" or "GET /contact"
    kubetail logs ngingx --grep "GET /(about|contact)" --force
 
    # Stream new records that match "GET /about"
    kubetail logs nginx --grep "GET /about" --follow --force
 
  - Source filters
 
    # Tail 'web' deployment pods in 'us-east-1'
    kubetail logs deployments/web --region=us-east-1
 
    # Tail 'web' deployment pods in 'us-east-1' or 'us-east-2'
    kubetail logs deployments/web --region=us-east-1,us-east-2
 
    # Tail 'web' deployment pods in 'us-east-1' running on 'arm64'
    kubetail logs deployments/web --region=us-east-1 --arch=arm64
 
    # Tail 'web' deployment pods in 'us-east-1a' zone
    kubetail logs deployments/web --zone=us-east-1a
 
    # Tail 'web' deployment pods in 'us-east-1a' or 'us-east-1b' zone
    kubetail logs deployments/web --zone=us-east-1a,us-east-1b
 
Notes:
 
  - The 'since' and 'until' flags accept the following:
 
    * ISO 8601 timestamp (e.g., "2006-01-02T15:04:05Z07:00")
    * ISO 8601 duration (e.g., "PT5M")
 
  - The 'after' and 'before' flags accept the following:
 
    * ISO 8601 timestamp (e.g., "2006-01-02T15:04:05Z07:00")
 
  - Using 'head'/'tail'/'all' flags together is not allowed
 
  - Default behavior is "tail" unless 'since' is specified
 
  - Using 'grep' requires 'force' because the command may unexpectedly download
    more log records than expected
 
Usage:
  kubetail logs [source1] [source2] ... [flags]
 
Flags:
      --kube-context string   Specify the kubeconfig context to use
  -h, --head int[=10]         Return first N records (default 10)
  -t, --tail int[=10]         Return last N records (default 10)
      --all                   Return all records
  -f, --follow                Stream new records
      --since string          Include records from the specified point (inclusive)
      --until string          Include records up to the specified point (inclusive)
      --after string          Include records strictly after the specified point
      --before string         Include records strictly before the specified point
  -g, --grep string           Filter records by a regular expression
      --region strings        Filter source pods by region
      --zone strings          Filter source pods by zone
      --os strings            Filter source pods by operating system
      --arch strings          Filter source pods by CPU architecture
      --node strings          Filter source pods by node name
      --with-ts               Show the timestamp of each record
      --with-node             Show the source node of each record
      --with-region           Show the source region of each record
      --with-zone             Show the source zone of each record
      --with-os               Show the source operating system of each record
      --with-arch             Show the source architecture of each record
      --with-namespace        Show the source namespace of each record
      --with-pod              Show the source pod of each record
      --with-container        Show the source container of each record
      --with-cursors          Show paging cursors
      --hide-header           Hide table header
      --force                 Force command (if necessary)
      --help                  help for logs
Last updated on
helpserve