> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sawmills.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Live Tail

> Stream logs in real time through your Sawmills pipeline. Compare events before and after each processor to validate filters and troubleshoot issues.

## Overview

Live Tail lets you watch sampled telemetry flow through your pipeline in real time. Use it to inspect data at key points in the pipeline, including before processing, after processor blocks, and from supported destination output previews.

<Note>
  Live Tail shows a **sample** of incoming events to reduce bandwidth and keep the UI responsive.
</Note>

## Open Live Tail

Live tail can be accessed in many parts of the application

* Top level navigation menu - Live Tail tab
* Inside a pipeline (Live tab), from pipeline paths and supported destination output previews
* Building a processor
* Deployed processor page

<Note> When accessed from the top navigation menu, Live Tail displays telemetry data from the midpoint of the pipeline, prior to processing by any configured processors. </Note>

## Destination Output Preview

When viewing a specific pipeline in **Live** mode, click a supported destination and select **Preview Output**. This opens a sampled stream for that destination, so you can inspect telemetry after destination-specific handling.

Use destination output preview when you need to confirm what a backend destination receives. Some destinations, such as Datadog, Elasticsearch, or other integrations, can reshape telemetry before export. Output preview helps you compare the destination output with the data seen earlier in the pipeline.

## Live Stream View

When Live Tail opens, a sampled stream begins scrolling.

* Each row contains the `timestamp` and `severity` of the event.
* Expand a row to see the full structured payload. Expanding **pauses** the stream; collapsing **resumes** it.
* Use the **Pause / Start** button in the upper‑right corner to control the stream manually.

## Filtering the Stream

1. Click **Add Condition** in the filter section.
2. Choose a field (attribute, resource, body, or severity).
3. Select an operator (equals, contains, regex, etc.).
4. Enter a value and press **Enter**.

Live Tail automatically re‑evaluates the stream whenever filters change. Multiple conditions are combined with **AND** logic by default. Select **Match any** to use **OR**.

<Note>
  Filters are evaluated **client‑side** on the sampled stream; they don’t change what the collector ingests.
</Note>

## Expanded Log View Options

When you expand a log entry to view all its keys and values, a context menu appears on hover to the left of each row:

1. **Copy Value** – copy just the value to your clipboard.
2. **Copy Key & Value** – copy the pair in `key=value` form.
3. **Generate Regex** - generate and copy a regex pattern matching the value (may take \~1s)
4. **Generate Grok Pattern** - generate and copy a grok pattern matching the value (may take \~1s)
5. **Show Logs with This Value** – add an *equals* filter for this field to the Live Tail filter bar.
6. **Exclude Logs with This Value** – add a *not equals* filter for this field.

To copy the *entire* log line as formatted JSON, click the **Copy JSON** icon in the upper‑right corner of the expanded view.

To debug and understand which processors will impact a specific log line., click on **Processors Impacting This Log** Button from the upper‑right corner
<Note>**Processors Impacting This Log** is available only from the top level navigation live-tail</Note>