Tail it with color

So, when you tail too many files and you don't have time to configure your shell with custom coloring there is a simple way to tail with color. It's a simple and basic approach to see some colors on the lines you were searching for.

First things first, create a new sh file, I preferred "tailitymf.sh" though I'm not really good with names, and put some pre color options to it as below.

#!/bin/sh
shopt -s expand_aliases

alias grey-grep="GREP_COLOR='1;35;38' grep -E --color=always --line-buffered"
alias red-grep="GREP_COLOR='1;24;41' grep -E --color=always --line-buffered"
alias green-grep="GREP_COLOR='1;32;39' grep -E --color=always --line-buffered"
alias yellow-grep="GREP_COLOR='1;34;37' grep -E --color=always --line-buffered"
alias cyan-grep="GREP_COLOR='1;36' grep -E --color=always --line-buffered"

tail $@ | grey-grep "[A-Z][a-z][a-z]\s[0-9][0-9][0-9: ]+|$" | red-grep "Fatal|FATAL|ERROR|Error$" | yellow-grep "Warning|WARNING|NOTICE|Notice*|$" | awk '{print "\n",$0}'

After you successfully save your file, next step making it executable with chmod +x so you can run it more easily and if you want you can just symlink it to /usr/bin.

This is where the coloring configured; it uses grep to color outputs. For colors you can check the gnu page and give a point to this person for a nice detailed explanation for coloring https://askubuntu.com/a/1042242

alias grey-grep="GREP_COLOR='1;35;38' grep -E --color=always --line-buffered"

Next step is defining some grep options so we can tail with these nice colors. You can use regular expressions to match things or simple keywords as below, then awk will print it out for you. You can add more colors and filters using pipes.

tail $@ | red-grep "Fatal|Error$" | yellow-grep "Warning$" | awk '{print "\n",$0}'

Enhanced Version

Here's an enhanced version of the script with more features:

#!/bin/bash
# tailitymf.sh - Colorful log tailing utility
# Usage: tailitymf.sh [options] file1 [file2 ...]

# Enable bash options
shopt -s expand_aliases

# Define color aliases with better visibility
alias grey-grep="GREP_COLOR='1;30;47' grep -E --color=always --line-buffered"
alias red-grep="GREP_COLOR='1;37;41' grep -E --color=always --line-buffered"
alias green-grep="GREP_COLOR='1;37;42' grep -E --color=always --line-buffered"
alias yellow-grep="GREP_COLOR='1;30;43' grep -E --color=always --line-buffered"
alias blue-grep="GREP_COLOR='1;37;44' grep -E --color=always --line-buffered"
alias magenta-grep="GREP_COLOR='1;37;45' grep -E --color=always --line-buffered"
alias cyan-grep="GREP_COLOR='1;30;46' grep -E --color=always --line-buffered"

# Help function
show_help() {
    echo "Usage: tailitymf.sh [options] file1 [file2 ...]"
    echo "Options:"
    echo "  -n NUM     Show NUM lines (default: 10)"
    echo "  -f         Follow mode (like tail -f)"
    echo "  -h         Show this help"
    exit 0
}

# Parse options
TAIL_OPTS=""
while getopts "n:fh" opt; do
    case $opt in
        n) TAIL_OPTS="$TAIL_OPTS -n $OPTARG" ;;
        f) TAIL_OPTS="$TAIL_OPTS -f" ;;
        h) show_help ;;
        *) show_help ;;
    esac
done
shift $((OPTIND-1))

# Check if files are provided
if [ $# -eq 0 ]; then
    echo "Error: No files specified"
    show_help
fi

# Main command with enhanced pattern matching
tail $TAIL_OPTS "$@" | \
    grey-grep "[A-Z][a-z][a-z]\s[0-9][0-9][0-9: ]+|$" | \
    red-grep "Fatal|FATAL|ERROR|Error|Exception|EXCEPTION|FAIL|Fail|failed|FAILED|$" | \
    yellow-grep "Warning|WARNING|NOTICE|Notice|WARN|Warn|$" | \
    green-grep "Success|SUCCESS|PASS|Pass|passed|PASSED|$" | \
    blue-grep "INFO|Info|INFORMATION|Information|$" | \
    cyan-grep "DEBUG|Debug|TRACE|Trace|$" | \
    awk '{print "\n",$0}'

This enhanced version includes:

1. Better command-line option handling
2. More color options for different log levels
3. Improved pattern matching for common log patterns
4. Help documentation

Usage Examples

Basic usage:

./tailitymf.sh /var/log/syslog

Follow mode with 20 lines initially:

./tailitymf.sh -f -n 20 /var/log/application.log

Tailing multiple files:

./tailitymf.sh -f /var/log/nginx/access.log /var/log/nginx/error.log

Alternative Tools

Not to forget, there are already very nice tools developed by the community you can use. For example, tailspin is a very nice example for this https://github.com/bensadeh/tailspin. And if you are working with web apps and want an analyzer, you can check https://github.com/allinurl/goaccess.

Other alternatives include:

1. lnav - Log file navigator with built-in coloring: https://lnav.org/
2. multitail - Monitor multiple log files with coloring: https://www.vanheusden.com/multitail/
3. ccze - Robust log colorizer: https://github.com/cornet/ccze

Performance Considerations

For very large log files or high-volume logs, consider using tools like grep --line-buffered directly or awk with pattern matching to reduce the number of piped commands, which can improve performance.

For example:

tail -f logfile.log | awk '
/ERROR|FATAL/ {print "\033[1;31m" $0 "\033[0m"; next}
/WARN|WARNING/ {print "\033[1;33m" $0 "\033[0m"; next}
/INFO/ {print "\033[1;34m" $0 "\033[0m"; next}
/DEBUG/ {print "\033[1;36m" $0 "\033[0m"; next}
{print}
'

This approach uses ANSI color codes directly in awk, reducing the number of processes involved in the pipeline.