Home / Documentation / Getting Started

Getting started with logging24

This guide takes you from account setup to two concrete outcomes: your first live log forwarding run and your first successful query.

What you will do

  1. Create a write token for ingest.
  2. Forward a log source into logging24.
  3. Create a read token for search.
  4. Run a first query with the l24 CLI.

Choose your first ingest path

For production Linux hosts, the recommended path is the native Linux binary forwarder. For general CLI-driven workflows across platforms, use l24 forward .

Production Linux Linux Binary
Cross-platform or ad hoc setup l24 CLI forwarding

1. Create a write token

Create a write token in the logging24 web UI. Write tokens are required for l24 forward and l24 import .

Token handling

Store tokens in environment variables or files where possible. Avoid passing raw tokens directly on the shell command line. 

export L24_WRITE_TOKEN='your-write-token'

2. Forward your first live logs

Option A: recommended production path on Linux 

curl -sSL https://logging24.com/install | bash
l24 forward -t env://L24_WRITE_TOKEN tail /var/log/syslog

This starts forwarding new lines from /var/log/syslog into logging24. For a production service setup, continue with Linux Binary .

Option B: forward systemd journal entries 

l24 forward -t env://L24_WRITE_TOKEN journal "UNIT=nginx.service"

This is useful when your primary source of truth is the systemd journal rather than plain log files.

3. Optional: import historical logs

If you already have archived logs, import them with the same write token: 

l24 import /var/log/archive.log.gz env://L24_WRITE_TOKEN

Use l24 import for parser, encoding, state, and dry-run details.

4. Create a read token and run your first query

Create a read token in the web UI, then export it and your customer identifier: 

export L24_READ_TOKEN='your-read-token'
export L24_CUSTOMER='your-customer-id'
l24 query --customer "$L24_CUSTOMER" ".*" env://L24_READ_TOKEN
l24 query --customer "$L24_CUSTOMER" ".*ERROR.*" env://L24_READ_TOKEN

The first query confirms that your logs are searchable. The second is a practical first filter for error lines.

What to learn next