We use cookies or similar technologies to personalize your online experience and tailor marketing to you. Many of our product features require cookies to function properly. Your use of this site and online product constitutes your consent to these personalization technologies. Read our Privacy Policy to find out more.

X

Backfilling existing events

If you have a number of old log files that you’d like to load into Honeycomb, use honeytail with the --backfill flag.

Note: honeytail does not unzip log files, so you’ll need to do this before backfilling.

Here’s an example honeytail invocation to pull in multiple existing logs and as much as the current log as possible.

honeytail \
    -c /etc/honeytail/honeytail.conf \
    --file=/var/log/app/myapp.log.* \
    --file=/var/log/app/myapp.log \
    --backfill

Let’s break down the various parts of this command.

Honeytail will read all the content in all the old logs and then stop. When it finishes, you’re ready to send new log lines. By default, honeytail will keep track of its progress through a file, and if interrupted, will pick back up where it left off. By launching honeytail pointing at the main app log, it will find the state file it created while reading in the backlog and start up where it left off.

Here’s the second honeytail invocation, where it will tail the current log file and send in recent entries:

honeytail \
    --writekey=YOUR_API_KEY \
    --parser=json \
    --dataset='My App' \
    --file=/var/log/app/myapp.log

You are currently logged in to the team, so we have populated the write key here to the first write key for that team.

You can find more detail about honeytail options on the Honeytail page.