Kubectl Logs Tail | How to Tail Kubernetes Logs

The kubectl logs tail command is critical in troubleshooting Kubernetes based applications and understanding what’s going on inside of a pod running on Kubernetes. This command is frequently used by engineers who need to understand what’s going on with a specific pod at a deep level in an effort to debug issues and optimize performance.

In this article, we’ll cover how to use the kubectl logs talk command, understand some basic use cases, and dive into more advanced features and extensions available for end-users.

Fundamentals of the kubectl logs command

We’ve covered a variety of ways to retrieve kubernetes logs from pods in a previous article you can reference here - Essential Kubernetes Skills: How to Get Logs from Pods Using kubectl. In short, you need to be familiar with commands to retrieve pods, understand various namespaces within Kubernetes, and basics of logging.

By issuing the following commands, you can expect a long list of logs to scroll through your terminal as they are issued:

kubectl logs "pod_name"

kubectl logs "pod_name" -n "namespace_name"

Fundamentals of the kubectl logs tail command

It’s important to note that in many instances, you’ll need to retrieve a specific set of logs that may not be displayed, or simply scroll through quickly via the kubectl logs command. Therefore, it’s important to understand the various modifiers in order to effectively retrieve the logs you need to troubleshoot the pod faster.

Kubectl logs --tail command

The most fundamental way of using the Kubectl logs --tail command allows the user to specify the number of the most recent logs they want displayed in their terminal. Here are the two commands we’ve seen above with the modifier to display the 10 most recent log entries:

kubectl logs --tail=10 "pod_name"

kubectl logs --tail=10 "pod_name" -n "namespace_name"

As one would expect, you can adjust the number of most recent logs to pull by changing 10 to another integer.

Kubectl logs --tail Container Commands

While troubleshooting an application running on Kubernetes, you’ll find yourself digging through a large amount of logs. Various extensions of the --tail command are available to segment the logs from various sources. One of the ways to segment the logs coming from a single pod is by containers. In other words, a single pod may contain multiple containers. In this case, you can retrieve the logs related to all or a specific container using the commands below.

kubectl logs --tail=10 --all-containers "pod_name"

kubectl logs --tail=10 --all-containers "pod_name" -n "namespace_name"

kubectl logs --tail=10 -c "container_name" "pod_name"

kubectl logs --tail=10 -c "container_name" "pod_name" -n "namespace_name"

Note that you can retrieve a certain amount, or all logs from a specific container. In other words, you may choose to remove the --tail=10 modifier.

Kubectl logs --tail flow Commands

If you’re looking to monitor the logs of your pod, or container continuously, you can add the “-f” modifier. This action will update the Terminal as new log entries for the target asset are added.

kubectl logs --tail=10 -f "pod_name"

kubectl logs --tail=10 -f "pod_name" -n "namespace_name"

To exit the scrolling logs, press Ctrl + C on the keyboard.

Kubectl logs --tail “terminated” pod Commands

Once a pod is terminated, the logs can be retrieved by using the “-p” modifier.

kubectl logs --tail=10 -p "pod_name"

kubectl logs --tail=10 -p "pod_name" -n "namespace_name"

Kubectl logs “Since” Modifier

The since modifier allows the user to specify a time period for which to retrieve the logs. It can be paired with some, or all of the modifiers we’ve listed above. Here are a few examples of commands that incorporate the since modifier.

kubectl logs --tail=10 --since=1h "pod_name"

kubectl logs --tail=10 --since=5m "pod_name"

kubectl logs --tail=10 --since=30s "pod_name"

Conclusion on the kubectl logs tail Command

We’ve shown you a variety of commands and modifiers used to retrieve and monitor logs from pods, containers, etc in Kubernetes. DevOps, SRE, and Platform engineers use these commands to troubleshoot production issues in numerous organizations.It’s important to note that a variety of tools exist to help end-users to better collect logs, decipher the information within them, process the ones that matter, and make decisions to fix issues or optimize performance.