Logstash log tail in browser

Question

So I setup Logstash 1.4.2 with ElasticSearch and Kibana using logstash-forwarder(lumberjack) and thats working pretty well but I also wanted to show just a raw log output(maybe searchable) via a browser similar to something like papertrail?

Is this possible, thanks!

Vituperate

Answer 1

In the discover view, in the top-right corner, there is a play (triangle) button. Press that and your log output should periodically update (default every 10 seconds for me).

Funches

Where is this setting in Kibana v5? – Elliott

To answer my own question – it becomes visible after clicking the time picker. – Elliott

Answer 2

Checkout my new Kibana plugin LogTrail, that supports live tail, search and option seek to a particular time in logs in console like GUI.

Undies

Answer 3

There are command line utilities that can tail or query logs stored in elasticsearch. While they're not web based, they may achieve what you need.

• EsTail: https://github.com/ElasticSearchCLITools/esTail

To tail the logs using EsTail issue the following command:

node ./esTail.js --url=localhost:9200 --index=logstash*

• Elktail: https://github.com/knes1/elktail

To tail the logs using Elktail issue the following command:

elktail --url localhost:9200

More info on Elktail can be found in blogpost here.

Disclaimer: I'm author of Elktail

Cyme

Answer 4

I might not be following exactly... how would what you desire differ from what Kibana can offer?

Anyway, I think there are a number of options, write your own web proxy that just queries recent data from elasticsearch (could then have search too) or use the stdout type output and serve that up on your web server, could rotate that flat file to get a 'tail' like view. Or even send the data to papertrail if you really like that tail and search interface.

Purapurblind

Answer 5

There is no "live tail" functionality in kibana.

Unless you're Rainman, or your boss is impressed by content-less blinking lights, ask yourself deeply why you want it.

Extramarital

A tail function could make sense to debug some issues... the days of ssh'ing into systems are over. – Parting

Having a live tail in some lockdown environments is the only way to see the logs. We use Kibana and it's possible to configure it for this purpose (-1 for the offensive comment, mate) – Interradial

@spaniard how did you configure this in kibana? – Levileviable

At 20000 events/sec (a medium-sided installation), what do you think you're going to see going by in a live tail? Unless you have amazingly good visual pattern matching skills? – Extramarital

You may want to tail a single host, or a single application. – Beside

With plugins live streaming is possible. There's no reason to be snarky over it. This has plenty of application and it's even one of the big features added to Sumo Logic that I'd wanted and love to have. When following a single host or a couple in a slow environment (beta maybe) it's very useful. – Arratoon