Skip to main content
bronto tail works like tail -f for a Bronto dataset. It polls every --interval (default 3s), looks back --window (default 30s) on each poll, and prints events it hasn’t shown yet. Errors are shown in red and warnings in yellow.

Following checkout-service errors live

It takes the same positional WHERE query and -d/--from-expr dataset selection as bronto search. Stop it with Ctrl-C. To print the current window once and exit, for example in a script, add --no-follow:
At a terminal each line is the timestamp, the severity, the origin host, and the original log line. Piped, tail prints JSON Lines instead.

​
Include, exclude, highlight

These flags filter the printed lines on the client side, after the query has run. Each takes a regex and can be repeated.
  • --include <regex> shows only matching lines. Several --include flags are ANDed.
  • --exclude <regex> hides matching lines.
  • --highlight <regex> colors matches without filtering anything.
Write field~regex to scope an include or exclude to a single field instead of the whole line:
--fields prints only the fields you name, in that order. tail asks the server for those fields, so use the names you’d write in a query, such as status, as you would with search --fields:

​
Live aggregates

With --select or -g/--group-by, tail switches to aggregate mode. It runs the same group-by query on every interval and, at a terminal, redraws the result in place as a small live dashboard with a trend sparkline per group. --select defaults to count(*).
With --no-follow it prints a single snapshot and exits:
The last line is the time of the snapshot (updated 09:41:07). Piped, each interval prints one JSONL line per group instead of redrawing, with the snapshot time in ts:

​
Tuning

Events are sorted within each poll but not across polls, so a late event can print after newer ones. An event whose timestamp is already older than --window by the time it becomes searchable is never printed: every poll asks for the last --window only. If events reach Bronto with a delay, use a larger --window, or use bronto search over a fixed time range when you need every event. On very high-volume streams, raise --dedup-size if you see repeated lines. For live tail concepts on the platform side, see Log Search on docs.bronto.io. bronto tail uses the live tail API.