l24 forward
l24 forward
forwards live log data to logging24 backends. This page tracks the current command syntax from
l24 forward --help
.
Usage
l24 forward [options] Top-level options
-t
,
--token
|
Default auth token for all sources. Must be a write token. |
--backend
|
Destination backend, repeatable. Default:
ingest.logging24.com:9000
.
|
--require-ack
|
Require remote acknowledgment. |
-b
,
--max-buffer-size
|
Override default buffer size. Default:
8M
.
|
Source types
Each source may take its own token after the main source argument. A per-source token overrides
--token
.
tail
tail [token] [--wait] [--prefix ] [--suffix ]
|
Path to the logfile to forward. |
--wait
|
Wait for the file to appear. |
--prefix
|
Add a prefix to every line. |
--suffix
|
Add a suffix to every line. |
stream
stream [token] [--prefix ] [--suffix ]
|
Path to the stream to forward. Use
-
for stdin.
|
--prefix
|
Add a prefix to every line. |
--suffix
|
Add a suffix to every line. |
journal
journal [token] [--exclude ] [--from-boot]
|
Comma-separated journal filter like
FIELD=value
.
|
--exclude
|
Exclude a field from output. Repeatable. |
--from-boot
|
Start from the current boot. |
Filter semantics for journal
The filter is split at commas. Matches of different fields are combined with logical AND. Matches of the same field are combined with logical OR.
journal "UNIT=nginx.service"
journal "UNIT=nginx.service,PRIORITY=3"Examples
l24 forward tail /var/log/syslog file:///etc/l24/write_token
l24 forward -t env://L24_TOKEN_PROD \
tail /var/log/app.log --prefix "prod-" \
journal "UNIT=nginx.service"