Tailing few lines from huge logs of kubectl logs -f

Question

kubectl logs -f pod shows all logs from the beginning and it becomes a problem when the log is huge and we have to wait for a few minutes to get the last log. Its become more worst when connecting remotely. Is there a way that we can tail the logs for the last 100 lines of logs and follow them?

score 210 · Accepted Answer · edited Apr 19 '23 at 07:00

210

In a cluster best practices are to gather all logs in a single point through an aggregator and analyze them with a dedicated tool. For that reason in K8S, log command is quite basic.

Anyway kubectl logs -h shows some options useful for you:

# Display only the most recent 20 lines of output in pod nginx
kubectl logs --tail=20 nginx

# Show all logs from pod nginx written in the last hour
kubectl logs --since=1h nginx

Some tools with your requirements (and more) are available on github, some of which are:

edited Apr 19 '23 at 07:00

Yann39

14,285
11
56
84

answered Aug 14 '18 at 07:06

Nicola Ben

10,615
8
41
65

8

also `--timestamps` is helpful if you need logs with timestamps – surazzarus Jun 20 '19 at 13:55
New to this stuff, are there any official recommendations for how to aggregate the logs? – Arrow_Raider Mar 30 '21 at 15:22
fluentd, logstash, look in google for other. – Nicola Ben Mar 31 '21 at 10:39
5

Is there a way to view the start of the logs? Like `--head=50` would show me the first 50 lines of the logs? I did run `kubectl logs -h` to see all options but couldn't find one that returns the head of logs. – Ram Patra Jul 29 '21 at 11:21

score 42 · Answer 2 · answered Aug 14 '18 at 07:29

42

Try kubectl logs -f pod --tail=10

answered Aug 14 '18 at 07:29

Kun Li

2,570
10
15

score 11 · Answer 3 · answered May 27 '21 at 12:06

To fetch tail lines from logs of a pod with multi containers.

kubectl logs <pod name> --all-containers=true --tail=10

To fetch tail lines from logs of pods within an application:

kubectl logs --selector app=<your application> --tail=10

(ex:if your application has 3 pods then output of above command can be 30 logs 10 of each pod logs)

bruce wyen · Answer 4 · 2022-02-17T10:02:46.780

8

You can ues this way to get the first 10 lines

kubectl logs my-pod-name  -n my-ns | head -n 10

edited Feb 17 '22 at 10:02

answered Feb 11 '22 at 03:42

bruce wyen

115
1
2

2

They are looking for the last 100 lines, not the first lines – Ascalonian Feb 23 '22 at 16:20

score 0 · Answer 5 · answered Apr 19 '21 at 14:41

0

You can also follow logs from the end if you are testing something:

kubectl logs my-pod-name --follow

This will work just like running tail -f in bash or other shells.

answered Apr 19 '21 at 14:41

rpena

55
3

This doesn't answer the OPs question and results in the same problem for large logs. You should consider removing this answer, else it will get down voted – fose May 17 '21 at 07:00

Tailing few lines from huge logs of kubectl logs -f

5 Answers5