Tail Logs In Kubernetes

The short answer

In Kubernetes, to get all the logs generated by all the containers of a specific Pod from the beginning, you can use the kubectl logs command as follows:

$ kubectl logs <pod>

Run in Warp

Where:

• pod is the name of the Pod you want to get the logs of.

For example, the following command will output all the logs of the Pod named hello-app:

$ kubectl logs hello-app

Run in Warp

Outputting the logs of a single container

To output of the logs of a specific container running within a Pod, you can use the -c flag (short for --container) as follows:

$ kubectl logs <pod> -c <container>

Run in Warp

Where:

• container is the name of the container within the specified pod.

For example, the following command will only show the logs of the container named hello-app-container running within the Pod named hello-app:

$ kubectl logs hello-app -c hello-app-container

Run in Warp

Note that the -c flag can be combined with any other flag described in this article.

Outputting the last N log lines

To only output the last N log lines of a Pod, you can use the --tail option as follows:

$ kubectl logs --tail=<lines> <pod>

Run in Warp

Where:

• lines is the number of log lines you want to display.

For example, the following command will show the 10 most recent logs of the Pod named my-pod:

$ kubectl logs --tail=10 my-pod

Run in Warp

Easily retrieve this command using Warp’s AI Command Suggestions

If you’re using Warp as your terminal, you can easily retrieve this command using the Warp AI Command Suggestions feature:

Entering kubernetes last 10 logs in the AI command search will prompt a kubectl command that can then be quickly inserted into your shell by doing CMD+ENTER.

Outputting logs in real-time

To monitor the logs of all the containers running within a Pod in real-time, you can use the kubectl logs command with the -f flag (short for --follow) as follows:

$ kubectl logs -f <pod>

Run in Warp

For example, the following command will continuously output the logs of the Pod named hello-app:

$ kubectl logs -f hello-app

Run in Warp

Note that, by default, the -f flag will combine the logs of all the containers running within that Pod.

Outputting the logs of multiple Pods simultaneously

In Kubernetes, there is at the moment no built-in command to view logs of multiple pods simultaneously. There are nonetheless certain ways you can achieve the same result.

For example, you can use the following command:

$ kubectl get pods -o name | xargs -I % sh -c 'kubectl logs % -f &'

Run in Warp

Where:

• kubectl get pods selects all the Pods from the current Kubernetes cluster.
• -o name outputs the Pods’ name only.
• xargs gets its input from the previous command and runs another command for each input.
• -I % tells xargs to replace the % with each input line (i.e., the name of each Pod).
• sh -c invokes the shell to execute the command that follows.
• 'kubectl logs % -f &'  is the command that will be executed by xargs for each Pod.

For example, the following command will show in real-time the logs of all the Pods with the label app=hello-world:

$ kubectl get pods -l app=hello-world -o name | xargs -I % sh -c 'kubectl logs % &'

Run in Warp

You can learn more about filtering Pods by reading our other article on how to list pods in Kubernetes with kubectl.

Filtering logs by time and date

To filter Pod logs based on timeframes, you can either use the --since flag to fetch the logs that occurred after a relative time:

$ kubectl logs <pod> --since=<time>

Run in Warp

Where:

• time is a relative duration expressed in the following format: <number>[h|m|s]  where h ,m ,s  stand for hours, minutes, and seconds.

Or you can use the --since-time flag to fetch the logs that occurred after a specific date and time:

$ kubectl logs <pod> --since-time=<time>

Run in Warp

Where:

• time is an RFC3339 date in the following format: YYYY-MM-DDTHH:MM:SSZ.

For example, the following command will show all the logs generated by the Pod named my-pod in the last 10 minutes:

$ kubectl logs my-pod --since=10m

Run in Warp

And the following command will show all the logs generated by the same Pod since March 1st, 2024:

$ kubectl logs my-pod --since-time=2024-03-01T00:00:00Z

Run in Warp

Filtering logs based on patterns with grep

To filter the container logs of a Pod based on specific keywords or patterns, you can pipe the output of the kubectl logs command into the grep command using the following syntax:

$ kubectl logs <pod> | grep <pattern>

Run in Warp

Where:

• <pattern> is a search string or any valid regular expression.

For example, the following command will only show the logs of the Pod named hello-world containing the word error in it:

$ kubectl logs hello-world | grep 'error'

Run in Warp

And the following command will only show the logs starting with either Error or Warning:

$ kubectl logs hello-world | grep -E '^(Error|Warning)'

Run in Warp