



Configuration Parameters

The plugin supports the following configuration parameters:

















The interval of refreshing the list of watched files in seconds.



Specify the number of extra time in seconds to monitor a file once is rotated in case some pending data is flushed.



Ignores files that have been last modified before this time in seconds. Supports m,h,d (minutes, hours,days) syntax. Default behavior is to read all specified files.







Set a default synchronization (I/O) method. Values: Extra, Full, Normal, Off. This flag affects how the internal SQLite engine do synchronization to disk, for more details about each option please refer to this section.










Set a tag (with regex-extract fields) that will be placed on lines read. E.g. kube.<namespace_name>.<pod_name>.<container_name>




Multiline Configuration Parameters









Wait period time in seconds to process queued multiline messages



Name of the parser that matchs the beginning of a multiline message. Note that the regular expression defined in the parser must include a group name (named capture)



Docker Mode Configuration Parameters

Docker mode exists to recombine JSON log lines split by the Docker daemon due to its line length limit. To use this feature, configure the tail plugin with the corresponding parser and then enable Docker mode:





If enabled, the plugin will recombine split Docker log lines before passing them to any parser as configured above. This mode cannot be used at the same time as Multiline.



Wait period time in seconds to flush queued unfinished split lines.


Getting Started


Command Line



Configuration File


Name tail
Path /var/log/syslog
Name stdout
Match *

Tailing files keeping state




$ sqlite3 tail.db
-- Loading resources from /home/edsiper/.sqliterc
Enter ".help" for usage hints.
sqlite> SELECT * FROM in_tail_files;
id name offset inode created
1 /var/log/syslog 73453145 23462108 1480371857


Formatting SQLite


.headers on
.mode column
.width 5 32 12 12 10


Rotation with truncation (e.g. logrotate's copytruncate mode) is not supported.