Skip to main content

tail

Return only the last N results from the pipeline.

Syntax​

| tail [N]

Default: N = 10.

Examples​

-- Last 10 results
| tail

-- Last 20 error events
level=error | tail 20

-- Last events by time
| sort _time | tail 5

Notes​

  • Unlike head, tail must consume all input before producing output (blocking operator).

See Also​

  • head -- First N results
  • sort -- Order results