Unexpected behavior with --follow

[belousovbb]

Hi and thank you for this useful tool!

I’m trying to follow logs using hl directly, but I’ve run into some unexpected behavior. According to the README, this should work:

hl --follow --tail 100 tmp.log

But when I run it, it just hangs with empty lines — it doesn’t continue following the log like tail -f would.

However, this command works as expected:

tail -f tmp.log | hl -P --tail 100

It continuously prints new log lines and highlights them correctly.

So I’m wondering: Am I doing something wrong with hl --follow? Or is there a known issue with the follow mode

I’ve tested this with: • Docker container logs, using docker compose logs -f service_name | hl --follow • A manually appended file, using something like: echo "$LOG_ENTRY" >> tmp.log

[pamburus]

Could you please share which hl version you use and what operating system?

[pamburus]

Could you also share an example of a log line and the configuration file (if any)? Exact string values do not need to be shared. The overall format and set of predefined fields are sufficient. In particular, the timestamp field is important.

[belousovbb]

Sure!

Version: hl 0.31.2 OS: macOS 15.3.1

I’m testing with a file that initially contains a single log line. I append to it manually when I want to test --follow.

{"@timestamp":"2025-05-28T05:53:23.5724894+00:00","level":"Information","message":"Log message"}

I noticed that when I use a config file with:

fields:
  predefined:
    time:
      show: always
      names: ["@timestamp"]

it works as expected.

[pamburus]

The --follow mode requires timestamps to order entries chronologically, which can feel counterintuitive in some cases. Perhaps, processing entries without timestamps in simple FIFO order would be better rather than ignoring them.

[belousovbb]

Yes, it makes sense if there are several files and you want to preserve the chronological order. I think it’s a good idea. Maybe it’s worth sending a warning message that the timestamp alias wasn’t provided. Or emphasize it in help message.

Thank you for clarification!