How to Install and Use Stern on Linux to Tail Multiple Kubernetes Pod Logs

Debugging microservices and distributed containerised applications in Kubernetes frequently requires observing log outputs from multiple pods simultaneously. While the standard kubectl logs command allows tailing output from a single pod or container, it lacks native support for streaming logs across dynamically created replica pods, autoscaled deployments, or multiple distinct microservices matching a common selector. Stern is an open-source, highly efficient command-line utility built specifically to tail multiple pods and containers on Kubernetes with seamless regex pattern matching and colourised output.

In this guide, you will learn how to install Stern on Linux distributions, tail real-time container logs using regular expressions, filter output by timestamp and container name, and streamline your Kubernetes troubleshooting workflows.

What Is Stern and Why Use It Over kubectl logs?

In a standard production Kubernetes cluster, Deployments and StatefulSets spawn multiple pod replicas with randomised hash suffixes (e.g., api-gateway-7b8f9c4d5-x2z9p). When pods crash, restart, or scale horizontally, kubectl logs -f disconnects or fails to attach to newly scheduled replicas.

Stern overcomes these limitations through several architectural advantages:

• Dynamic Pod Discovery: Automatically attaches to newly scheduled pods matching your query and cleanly handles terminated pods.
• Colour-Coded Distinction: Assigns distinct terminal colours to each pod and container, allowing developers to distinguish log streams at a glance.
• Regex-Based Filtering: Matches pod names, container names, and namespaces using flexible regular expressions rather than rigid string equality.
• Multi-Container Support: Simultaneously tails multiple containers within the same pod (such as main application runtimes and sidecar proxies like Envoy or Istio).

Installing Stern on Linux

Stern is distributed as a standalone binary written in Go. You can install it on any modern Linux distribution, including Ubuntu, Debian, Fedora, Arch Linux, and CentOS.

Method 1: Installing Pre-Compiled Binaries (Recommended)

Download the latest release directly from GitHub releases and place it into your system executable path:

# Download the latest Stern binary archive for 64-bit Linux
curl -sSL https://github.com/stern/stern/releases/latest/download/stern_linux_amd64.tar.gz -o stern.tar.gz

# Extract the archive
tar -xzf stern.tar.gz

# Move the executable into /usr/local/bin
sudo mv stern /usr/local/bin/

# Make sure it has execute permissions
sudo chmod +x /usr/local/bin/stern

# Clean up archive artifacts
rm -f stern.tar.gz LICENSE README.md

# Verify the installation
stern --version

Method 2: Installing via Homebrew on Linux

If you use Linuxbrew, run:

brew install stern

Method 3: Installing via asdf or Krew

Stern can also be installed as a kubectl plugin using the Krew package manager:

kubectl krew install stern

Basic Usage and Query Syntax

Stern relies on your active kubeconfig context (typically located at ~/.kube/config). Before running Stern, ensure your active cluster context is configured correctly:

kubectl config current-context

Tailing All Pods in a Deployment

To tail all pods belonging to a deployment named auth-service:

stern auth-service

Stern treats auth-service as a regular expression. It will immediately begin streaming output from every pod whose name contains that substring (e.g., auth-service-5d4f7-8k2ln and auth-service-5d4f7-pl9vm).

Tailing Multiple Microservices Concurrently

You can use regex pipes (|) to tail logs across several interconnected services simultaneously:

stern "frontend|backend-api|payment-worker"

Filtering by Namespace and Container

Specifying Namespaces

By default, Stern queries the namespace defined in your active context. To tail pods in a specific namespace, use the -n or --namespace flag:

# Tail pods in the production namespace
stern auth-service -n production

# Tail pods matching a regex pattern across ALL cluster namespaces
stern auth-service --all-namespaces

Filtering by Specific Container Names

In Kubernetes pods running sidecar containers (such as logging agents or service mesh proxies), tailing all containers can clutter your terminal. Use -c or --container to isolate the main application:

# Tail only the "web" container, ignoring sidecars
stern frontend -c web

Conversely, to exclude a noisy sidecar container:

stern frontend -E istio-proxy

Advanced Log Streaming and Time Filtering

Filtering Output by Log Content Regex

To stream only log entries that contain specific error patterns or HTTP status codes, use the -i (include) flag:

# Stream only log lines containing "500" or "FATAL"
stern backend-api -i "(500|FATAL|Exception)"

Retrieving Recent Historical Logs

When investigating a newly reported incident, you often need recent context prior to tailing live events. Use --since to specify relative timeframes:

# Fetch logs from the last 15 minutes, then continue tailing
stern payment-service --since 15m

# Fetch only the last 100 log lines per pod
stern payment-service --tail 100

Displaying Timestamps

To include RFC3339-compliant UTC timestamps with each streamed line:

stern auth-service -t

Shell Completion Configuration

To enable bash or zsh autocompletion for Stern commands, add the completion script to your shell profile:

# For Bash users
echo "source <(stern --completion=bash)" >> ~/.bashrc
source ~/.bashrc

# For Zsh users
echo "source <(stern --completion=zsh)" >> ~/.zshrc
source ~/.zshrc