tail (Compute)

When To Use

Use tail to keep only the last lines of a table, typically the latest entries of a log or of an event list, once filtered. To keep the first lines instead, use head^[1].

Filtering first and keeping the last lines next returns the latest matching entries of the whole input, which tail -n on the host cannot do: it reads the last lines of the file, and the filter then keeps the few matching ones among them.

Syntax

sources:
  errors:
    type: commandLine
    commandLine: cat /opt/app/logs/server.log
    keep: ERROR
    computes:
    - type: tail
      lines: 20

Properties

Table Transformation Example

With lines: 2:

Recommended Pattern

• Filter first (the keep and exclude of a commandLine^[2] source, keepOnlyMatchingLines^[3], excludeMatchingLines^[4]), then keep the last lines.
• Put tail after sort^[5] to keep the bottom lines, e.g. the smallest values of an ascending sort.
• In a tool, let a parameter set lines, bounded by its pattern.

Common Mistakes

• Expecting tail to read less of a file: the source reads the whole output first. For a very large file where only the last lines matter, the command's own option (tail -n on Linux) reads less.
• Expecting lines: 0 to keep everything: it keeps no line.