Tail Logs In Kubernetes

The short answer

In Kubernetes, to get all the logs generated by all the containers of a specific Pod from the beginning, you can use the [.inline-code]kubectl logs[.inline-code] command as follows:

$ kubectl logs <pod>

Where:

• [.inline-code]pod[.inline-code] is the name of the Pod you want to get the logs of.

For example, the following command will output all the logs of the Pod named [.inline-code]hello-app[.inline-code]:

$ kubectl logs hello-app

[#output-container-logs] Outputting the logs of a single container [#output-container-logs]

To output of the logs of a specific container running within a Pod, you can use the [.inline-code]-c[.inline-code] flag (short for [.inline-code]--container[.inline-code]) as follows:

$ kubectl logs <pod> -c <container>

Where:

• [.inline-code]container[.inline-code] is the name of the container within the specified [.inline-code]pod[.inline-code].

For example, the following command will only show the logs of the container named [.inline-code]hello-app-container[.inline-code] running within the Pod named [.inline-code]hello-app[.inline-code]:

$ kubectl logs hello-app -c hello-app-container

Note that the [.inline-code]-c[.inline-code] flag can be combined with any other flag described in this article.

[#output-the-last-n-logs] Outputting the last N log lines [#output-the-last-n-logs]

To only output the last [.inline-code]N[.inline-code] log lines of a Pod, you can use the [.inline-code]--tail[.inline-code] option as follows:

$ kubectl logs --tail=<lines> <pod>

Where:

• [.inline-code]lines[.inline-code] is the number of log lines you want to display.

For example, the following command will show the 10 most recent logs of the Pod named [.inline-code]my-pod[.inline-code]:

$ kubectl logs --tail=10 my-pod

Easily retrieve this command using Warp’s AI Command Suggestions

If you’re using Warp as your terminal, you can easily retrieve this command using the Warp AI Command Suggestions feature:

Entering [.inline-code]kubernetes last 10 logs[.inline-code] in the AI command search will prompt a [.inline-code]kubectl[.inline-code] command that can then be quickly inserted into your shell by doing [.inline-code]CMD+ENTER[.inline-code].

[#output-logs-in-real-time] Outputting logs in real-time [#output-logs-in-real-time]

To monitor the logs of all the containers running within a Pod in real-time, you can use the [.inline-code]kubectl logs[.inline-code] command with the [.inline-code]-f[.inline-code] flag (short for [.inline-code]--follow[.inline-code]) as follows:

$ kubectl logs -f <pod>

For example, the following command will continuously output the logs of the Pod named [.inline-code]hello-app[.inline-code]:

$ kubectl logs -f hello-app

Note that, by default, the [.inline-code]-f[.inline-code] flag will combine the logs of all the containers running within that Pod.

[#output-multiple-pods-logs] Outputting the logs of multiple Pods simultaneously [#output-multiple-pods-logs]

In Kubernetes, there is at the moment no built-in command to view logs of multiple pods simultaneously. There are nonetheless certain ways you can achieve the same result.

For example, you can use the following command:

$ kubectl get pods -o name | xargs -I % sh -c 'kubectl logs % -f &'

Where:

• [.inline-code]kubectl get pods[.inline-code] selects all the Pods from the current Kubernetes cluster.
• [.inline-code]-o name[.inline-code] outputs the Pods’ name only.
• [.inline-code]xargs[.inline-code] gets its input from the previous command and runs another command for each input.
• [.inline-code]-I %[.inline-code] tells [.inline-code]xargs[.inline-code] to replace the [.inline-code]%[.inline-code] with each input line (i.e., the name of each Pod).
• [.inline-code]sh -c[.inline-code] invokes the shell to execute the command that follows.
• [.inline-code]'kubectl logs % -f &'[.inline-code]  is the command that will be executed by [.inline-code]xargs[.inline-code] for each Pod.

For example, the following command will show in real-time the logs of all the Pods with the label [.inline-code]app=hello-world[.inline-code]:

$ kubectl get pods -l app=hello-world -o name | xargs -I % sh -c 'kubectl logs % &'

You can learn more about filtering Pods by reading our other article on how to list pods in Kubernetes with kubectl.

[#filter-logs-by-time-and-date] Filtering logs by time and date [#filter-logs-by-time-and-date]

To filter Pod logs based on timeframes, you can either use the [.inline-code]--since[.inline-code] flag to fetch the logs that occurred after a relative time:

$ kubectl logs <pod> --since=<time>

Where:

• [.inline-code]time[.inline-code] is a relative duration expressed in the following format: [.inline-code]<number>[h|m|s][.inline-code]  where [.inline-code]h[.inline-code] ,[.inline-code]m[.inline-code] ,[.inline-code]s[.inline-code]  stand for hours, minutes, and seconds.

Or you can use the [.inline-code]--since-time[.inline-code] flag to fetch the logs that occurred after a specific date and time:

$ kubectl logs <pod> --since-time=<time>

Where:

• [.inline-code]time[.inline-code] is an RFC3339 date in the following format: [.inline-code]YYYY-MM-DDTHH:MM:SSZ[.inline-code].

For example, the following command will show all the logs generated by the Pod named [.inline-code]my-pod[.inline-code] in the last 10 minutes:

$ kubectl logs my-pod --since=10m

And the following command will show all the logs generated by the same Pod since March 1st, 2024:

$ kubectl logs my-pod --since-time=2024-03-01T00:00:00Z

[#filter-logs-with-grep] Filtering logs based on patterns with [.inline-code]grep[.inline-code] [#filter-logs-with-grep]

To filter the container logs of a Pod based on specific keywords or patterns, you can pipe the output of the [.inline-code]kubectl logs[.inline-code] command into the [.inline-code]grep[.inline-code] command using the following syntax:

$ kubectl logs <pod> | grep <pattern>

Where:

• [.inline-code]<pattern>[.inline-code] is a search string or any valid regular expression.

For example, the following command will only show the logs of the Pod named [.inline-code]hello-world[.inline-code] containing the word [.inline-code]error[.inline-code] in it:

$ kubectl logs hello-world | grep 'error'

And the following command will only show the logs starting with either [.inline-code]Error[.inline-code] or [.inline-code]Warning[.inline-code]:

$ kubectl logs hello-world | grep -E '^(Error|Warning)'