How do I tail a log file with colored output for errors?

Quick Linux Tip #30:

Try: tail -f /var/log/nginx/error.log | grep --line-buffered -E --color=always 'error|warn|critical|$'

Info: --color=always highlights matching text. The |$ pattern matches every line so non-matching lines still display. --line-buffered ensures real-time output.

Examples:

  • $ tail -f app.log | grep --line-buffered --color=always -E 'ERROR|WARN|$'
  • $ journalctl -f | grep --line-buffered --color=always -E 'Failed|Error|$'
  • $ multitail /var/log/nginx/error.log /var/log/nginx/access.log  # Watch multiple

Note: Without --line-buffered, piped output can be buffered into chunks instead of appearing immediately. For advanced multi-file tailing with custom colors per window, use multitail.




LinuxTeck.com
linuxteck@ubuntu:~$ tail -f /var/log/nginx/error.log | grep --line-buffered -E --color=always 'error|warn|critical|$'
2026-07-10 10:23:45 [notice] 1234#0: signal process started
2026-07-10 10:24:12 [error] 1235#0: *45 connect() failed (111: Connection refused)
while connecting to upstream
2026-07-10 10:25:33 [warn] 1236#0: *67 client sent invalid method while reading
request headers
2026-07-10 10:26:01 [notice] 1237#0: signal 15 (SIGTERM) received from 3456, shutting
down
2026-07-10 10:26:45 [critical] 1238#0: worker process 1235 exited on signal 11
^C
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #29: My process list shows <defunct> zombie entries. How do I clean them up? NEXT ARTICLE Quick Linux Tip #31: My disk is 95% full but I don't know what's eating the space. How do I find out?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.