bronto tail

Follows new events as they arrive (like tail -f). Every —interval it polls for events in the last —window and prints the ones it has not printed yet. Events are sorted within each poll but not across polls, so a late event can print after newer ones. An event whose timestamp is already older than —window by the time it becomes searchable is never printed. If events reach Bronto with a delay, use a larger —window, or ‘bronto search’ when you need every event.

Platform docs: docs.bronto.io/Search-and-Visualize/Log-Search
API reference: docs.bronto.io/api-reference/live-tail/initiate-a-live-tail-job

bronto tail [query] [flags]

Flags

Flag	Short	Type	Default	Description
`--dataset`	`-d`	stringArray		dataset name or UUID to tail (repeatable)
`--dedup-size`		int	`20000`	number of recent events remembered to drop duplicates across polls; raise it for very high-volume streams
`--exclude`		stringArray		hide lines matching this regex (repeatable)
`--from-expr`		string		dataset selector expression
`--group-by`	`-g`	stringArray		group-by key for live aggregates (repeatable; switches to aggregate mode)
`--highlight`		stringArray		highlight regex matches in the output (repeatable)
`--include`		stringArray		only show lines matching this regex (repeatable, ANDed)
`--interval`		duration	`3s`	polling interval (min 1s)
`--limit`	`-n`	int	`500`	max events per poll
`--no-follow`		bool		fetch the current window once and exit
`--select`		stringArray		aggregate to compute on each poll, e.g. count(*) (repeatable; switches to aggregate mode)
`--window`		string	`30s`	per-poll lookback window (single unit)

Also accepts the global flags.

Examples

bronto tail
bronto tail "level = 'error'" --include 'timeout' --exclude 'healthz'
bronto tail --no-follow --window 5m   # catch up, then exit
bronto tail -g status --window 1m     # live count(*) by status, redrawn in place

Start here

Guides

Configuration

Extend

Help

Reference

Flags

Examples

​Flags

​Examples

Flags

Examples