stern

Tail all pods within a current namespace

$ stern .

$ stern . --container-state [running|waiting|terminated]

$ stern [pod_query]

$ stern [pod_query] --all-namespaces

$ stern [pod_query] --since [15m]

$ stern [pod_query] --selector [release=canary]

stern [options] <pod-query> [container-query]

--all-namespaces
    Monitors pods across all Kubernetes namespaces, overriding any specified --namespace.

-c, --container <regex>
    Specifies a regular expression to match container names within the selected pods.

--container-state <state>
    Filters logs by the state of containers (e.g., running, waiting, terminated).

--context <name>
    Uses a specific Kubernetes context from your kubeconfig file.

-e, --exclude <regex>
    Excludes log lines that match the provided regular expression.

--exclude-container <regex>
    Excludes logs from containers whose names match this regular expression.

-f, --follow
    Continuously streams new log entries as they arrive (this is the default behavior).

--init-containers
    Includes logs from initialization containers in the output.

-l, --selector <label-query>
    Filters pods using Kubernetes label selectors (e.g., app=my-app,env=prod).

-n, --namespace <name|regex>
    Selects logs from specific Kubernetes namespaces, accepting a name or a regular expression. Can be comma-separated for multiple namespaces.

-o, --output <format>
    Sets the output format. Common formats include default, json, raw, template, and extjson.

--since <duration>
    Displays logs only from a specified duration ago (e.g., 5s, 2m, 3h). Default is 0s (all logs).

--tail <lines>
    Specifies the number of most recent log lines to display per container. Use -1 for all historical logs (default).

-t, --timestamps
    Prepends RFC3339 timestamps to each log line, showing when the log entry was generated.

--template <string>
    Provides a Go template string for custom log output formatting, useful for specific parsing needs.

--timezone <zone>
    Sets the timezone for displayed timestamps (e.g., UTC, America/New_York). Default is local.

-v, --version
    Prints the stern version information and exits.

stern is a powerful and user-friendly command-line utility designed for tailing logs from multiple pods and containers within a Kubernetes cluster. Unlike kubectl logs, which typically focuses on a single pod or container, stern allows users to concurrently monitor log streams from multiple sources, even across different namespaces and clusters.

It provides a unified, color-coded output, making it easy to distinguish logs from various origins. stern supports filtering by pod name, container name, and even regular expressions, enabling highly targeted log monitoring. It automatically re-attaches to new pods or containers matching the criteria as they are created or restarted, ensuring continuous log visibility for dynamic workloads. Its features make it an indispensable tool for debugging, monitoring, and troubleshooting applications deployed on Kubernetes.

stern is not a built-in Linux command; it must be installed separately. It requires kubectl to be configured and access to a Kubernetes cluster with appropriate RBAC permissions to read pod and log data. Performance can be impacted by the number of pods and the volume of logs being tailed.

stern automatically color-codes log output by pod and container, significantly improving readability when monitoring multiple sources simultaneously. It supports powerful regular expression filtering for both pod and container names, as well as for the log content itself, allowing users to focus on relevant information without being overwhelmed by noisy logs.

One of stern's key strengths is its ability to automatically discover and re-attach to new or restarted pods and containers that match the specified criteria. This ensures continuous, real-time log monitoring for dynamic Kubernetes workloads, providing uninterrupted visibility without manual intervention.

Developed by Wercker (later acquired by Oracle) and first released around 2017, stern quickly gained popularity as a crucial tool for Kubernetes development and operations. It addressed a significant gap in kubectl logs by providing a unified, color-coded view of logs from multiple pods and containers, making debugging and monitoring distributed applications much more efficient. Its active open-source community continues to maintain and enhance its capabilities.

kubectl(1), grep(1), tail(1)