---
title: "SSE live tail with full SPL2 pipeline"
method: GET
path: "/tail"
tags: ["Live"]
---

# SSE live tail with full SPL2 pipeline

`GET /tail`

Server-Sent Events stream for real-time log tailing with full SPL2 pipeline support.
Uses the same query engine as `POST /query`, but in streaming mode.

**Two phases:**

1. **Catchup** — replays the last `count` matching events from storage (time range: `from` to now).
   Each event is sent as `event: result`. Phase ends with `event: catchup_done`.
2. **Live** — streams new events from the EventBus through the SPL2 pipeline in real time.
   Events are sent as `event: result`. Heartbeat every 15s as `event: heartbeat`.

**Supported SPL2 commands** (streaming, event-by-event):
`search`, `where`, `eval`, `fields`, `table`, `rename`, `rex`, `fillnull`, `head`, `bin`.

Commands requiring full materialization (`stats`, `sort`, `join`, `dedup`, `timechart`, etc.)
are rejected with `422`.

```javascript
const es = new EventSource("/api/v1/tail?q=search+ERROR+|+where+status>500&count=100&from=-1h");
es.addEventListener("result",       (e) => appendRow(JSON.parse(e.data)));
es.addEventListener("catchup_done", (e) => showLiveIndicator());
es.addEventListener("heartbeat",    (e) => updatePing());
es.addEventListener("error",        (e) => showError(JSON.parse(e.data)));
```

SSE (not WebSocket) because this is a unidirectional server-to-client stream. SSE auto-reconnects,
passes through proxies, and works with the native `EventSource` browser API.

## Query parameters

- `q` string, required
- `count` integer
- `from` string

## Response `200`

SSE event stream

## Other responses

- `400` — Parse error — invalid SPL2 query
- `422` — Query contains unsupported commands for tail

---

[API](https://skmtc.net/lynxbase/apis/lynxdb-api.md) · [All operations](https://skmtc.net/lynxbase/apis/lynxdb-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lynxbase/lynxdb-api/revisions/4363a070c444/schema)