l24 CLI forwarding and import

The l24 CLI is the general-purpose ingestion path for logging24. It combines live forwarding and historical import in one tool.

When to use this

You want one CLI for both live logs and historical backfills.
You are working cross-platform or in ad hoc operational workflows.
You are replacing older qlg-fwd or qlg-importer workflows with the current l24 CLI.

Install

curl -sSL https://logging24.com/install | bash

Quickstart

Forward live logs

export L24_WRITE_TOKEN='your-write-token'
l24 forward -t env://L24_WRITE_TOKEN tail /var/log/app.log

Import historical logs

l24 import /var/log/archive.log.gz env://L24_WRITE_TOKEN

What this page covers

This page focuses on practical usage patterns. For exact flags and syntax, use the command reference pages linked below.

l24 forward	Live forwarding from files, streams, and systemd journals.
l24 import	Historical import with parser, encoding, timezone, state, and dry-run controls.

Common usage patterns

File tailing

l24 forward -t env://L24_WRITE_TOKEN tail /var/log/syslog
l24 forward -t env://L24_WRITE_TOKEN tail /var/log/app.log --wait

Journal forwarding

l24 forward -t env://L24_WRITE_TOKEN journal "UNIT=nginx.service"
l24 forward -t env://L24_WRITE_TOKEN journal "UNIT=nginx.service,PRIORITY=3" --from-boot

Stdin or FIFO streaming

cat app.log | l24 forward -t env://L24_WRITE_TOKEN stream -
l24 forward -t env://L24_WRITE_TOKEN stream /tmp/app.fifo

Backfilling archived data

l24 import /var/log/archive.log env://L24_WRITE_TOKEN
l24 import -n --guess-encoding /var/log/mystery.log env://L24_WRITE_TOKEN