Live Tail
Live Tail is a display mode that keeps streaming logs the moment they arrive in Datadog so you can follow them with your eyes without stopping. Because it streams not only the logs stored in indexes but also the logs that exclusion filters removed from search, you can verify on the spot whether your exclusion and pipeline settings are working as intended.
Overview
Live Tail is a display mode that starts streaming logs in near real time when you select it from the time frame in Log Explorer. Where a normal search works by "finding logs stored in an index after the fact," Live Tail works by "watching incoming logs as they are," and it includes logs that never enter an index (as of September 2026). It is the right tool for checks that are only valuable in the moment, such as seeing whether a process started correctly right after a deploy or inspecting the contents of logs an exclusion filter is dropping, and it is not suited to finding things again later.
Live Tail is a display mode that streams logs as they arrive
Live Tail is a display mode you switch to by selecting it from the time frame in Log Explorer, the central page of Log Management. Once you switch, log events arriving in Datadog start streaming in near real time, and you can watch them while narrowing them down with search syntax. The official documentation explains that on this page you can see both indexed and non-indexed logs flowing into Datadog (as of September 2026, Source: Live Tail). This single point, that you can see both, determines most of the use cases covered below.
Search and Live Tail look in opposite directions in time
Although you enter from the same page, search and Live Tail look at different things. Search works by sending a query to the logs stored in a Log Index, and you can go back into the past by specifying a period. Live Tail works by showing incoming logs in order, so you can only go back as far as the time the screen was open. Remember it as the direction of time being reversed and you will not mix them up. Another difference is scope: logs removed from the index by an exclusion filter never appear in search, not even one, but they do stream in Live Tail (as of September 2026). This difference is what lets you tell, when "a log I am sure I sent cannot be found in search," whether the problem is on the sending side or whether the index-side settings are dropping it.
Open it when the answer is only valuable in the moment
Live Tail is effective for the kind of check that loses its point a few minutes later. Right after releasing a new version, seeing whether the expected logs appear. A process or container has started, but not a single log is coming out. The official documentation also lists checking whether a process started correctly and checking whether a deploy went well as use cases (as of September 2026, Source: Live Tail). And right after fixing an exclusion filter, confirming that the logs you targeted stream through without being dropped. The processing results of a Log Pipeline can be checked with a preview built on the same mechanism in the pipeline editing page (as of September 2026, Source: Pipelines). Because processing and exclusion happen at the ingestion stage, the effect of a fix shows up in the logs that arrive after it. If you try to confirm with search, you have to wait for new logs to accumulate, but with Live Tail you can judge from the very next log that streams in.
Which point on the log's path you are looking at
The position of Live Tail is obvious at a glance when laid out along the path a log travels. An arriving log is parsed by pipelines and its attributes are organized (organized attributes can be used as search conditions as Facets), and then exclusion filters decide whether it enters an index. What Live Tail shows is the logs flowing before this decision. That is why logs shaken out by exclusion filters still appear on the screen, and conversely, appearing in Live Tail is no proof that a log entered an index.
- Applications and infrastructure emit logs
- Logs arrive in Datadog via the Agent or the API (ingestion)
- Log pipelines parse them and organize attributes
- Exclusion filter decision - whether the log enters an index is decided
- The remaining logs are used in search / dashboards / monitors
What goes wrong if you assume you can find it later
Relying on Live Tail as a copy of your logs is a risky way to use it. You cannot scroll back from that screen to logs that have already streamed past, so records you want to keep must be secured by storing them in an index and configuring Retention. Sampling is easy to overlook. When too many logs match the query, the display is thinned out to keep the volume readable. Because the thinning is uniform random sampling, it is enough to grasp the overall trend, but it misses things when you are trying to pinpoint one specific entry (as of September 2026, Source: Live Tail). When you want to conclude "it did not happen because not a single one appeared," the reliable approach is to narrow the conditions by service name or status code, shrink the population, and then watch.