Live tail
Streaming logs as they happen, so you can hit the button and watch the line appear. The hosted version of tail -f.
See it
What it is
Live tail is the real-time view of your log pipeline. Instead of querying the last 15 minutes, you open a stream and lines arrive as they are written. It is named after the Unix command tail -f, and every platform ships a version of it, labelled 'live tail', 'follow', or 'stream'. The workflow it exists for: trigger the thing in one window, watch it break in the other, no refresh button involved.
Reach for it during a deploy, while reproducing a bug someone just reported, or when a scheduled job is about to fire. Filter before you stream, not after: a live tail pointed at a busy production service is thousands of lines a second and completely unreadable, so pin it to one service, one log level, or one correlation ID first.
Gotchas: live tail usually reads a different path than the indexed store, so lines can appear seconds before they become searchable, and under load the stream drops lines rather than blocking. Treat it as a debugging aid, never as evidence of what did or did not happen. It is also where people accidentally read production PII over someone's shoulder, so it should honor the same redaction and access rules as stored logs. And browsers and proxies quietly kill an idle stream, so expect a silent stall rather than an error.
Ask AI for it
Add a live tail workflow to this project. Provide a script that streams the running service's logs in real time (the platform CLI, docker logs -f, or the log vendor's live tail API) with flags for service, environment, minimum log level, and a text filter. Pretty-print the structured JSON into readable colored lines when running locally while leaving raw JSON in CI, support filtering by correlation ID so one request can be followed live, auto-reconnect when the stream drops, and make sure token and email redaction happens before anything reaches the terminal.