> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vms.verolabs.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Probe: log_get

> Bounded log shipping with redaction

<Info>
  This probe is currently at the experimental stage.
</Info>

## Description

The `log_get` probe tails a log file and ships newly-appended lines to VMS ingress via `ProbeResult.Logs`. Supports multiline grouping and sensitive data redaction before export. Tracks the byte offset between runs and resets on truncation/rotation.

Unlike `log_mon` (which counts matches), `log_get` ships the log line **content**.

## Config fields

| Field                   | Type       | Required | Default | Description                                                                                                                                                                          |
| ----------------------- | ---------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `type`                  | `string`   | Yes      | —       | Must be `"log_get"`                                                                                                                                                                  |
| `filePath`              | `string`   | Yes      | —       | Log file path to ship                                                                                                                                                                |
| `readFromEnd`           | `bool`     | No       | `false` | `true`: first run ships only new lines (from EOF). `false` (default when omitted): reads from the start of the file — may ship the entire existing log, so set `true` for large logs |
| `maxBytesPerRead`       | `int64`    | No       | 8 MiB   | Per-run read window. Clamped to 8 MiB regardless of the configured value                                                                                                             |
| `multilineStartPattern` | `string`   | No       | —       | Regex marking the start of a new log entry. Non-matching lines join the previous entry. If empty, each line is one entry                                                             |
| `redactPatterns`        | `string[]` | No       | —       | Regex list — each match in a log line is replaced with `***` before shipping                                                                                                         |

## Metrics

| Metric                   | Type    | Unit | Description                     |
| ------------------------ | ------- | ---- | ------------------------------- |
| `vms.log_get.lines_sent` | counter | —    | Log entries shipped in this run |

## Example config

```json theme={null}
{
  "type": "log_get",
  "filePath": "/var/log/app/app.log",
  "readFromEnd": true,
  "maxBytesPerRead": 65536
}
```

**Multiline Java stack trace:**

```json theme={null}
{
  "type": "log_get",
  "filePath": "/var/log/app/app.log",
  "readFromEnd": true,
  "multilineStartPattern": "^\\d{4}-\\d{2}-\\d{2}",
  "redactPatterns": ["password=[^&\\s]+", "token=[^&\\s]+"]
}
```

## Notes

* **Redaction happens before shipping** — data matching `redactPatterns` never leaves the agent.
* A multiline entry split exactly at a read-window boundary may be shipped as two separate entries — acceptable for a bounded tailer.
* File missing or unreadable → status `down`, severity `warning`, no lines shipped.
* Only **complete lines** (ending with `\n`) are read.