kubernetes: Collect and parse the Kubernetes CRI (Container Runtime Interface) format
The kubernetes()
source collects container logs managed by the Kubelet. It reads plain-text and JSON-formatted container logs (as described in the Container Runtime Interface (CRI) design proposal), for example, from the /var/log/containers
or /var/log/pods
files, and enriches them with various metadata retrieved from the Kubernetes API.
The kubernetes()
source is available in AxoSyslog version 3.37 and later.
By default, it reads the /var/log/containers
folder and extracts:
- the log content, and
- Kubernetes metadata, for example, namespace, pod, and container information.
The Kubernetes-related metadata is available in name-value pairs with the .k8s.
prefix. The following table shows the retrieved metadata and their source:
syslog-ng name-value pair |
source |
---|---|
.k8s.namespace_name |
Container log file name. |
.k8s.pod_name |
Container log file name. |
.k8s.pod_uuid |
Container log file name or python kubernetes.client.CoreV1Api. |
.k8s.container_name |
Container log file name or python kubernetes.client.CoreV1Api. |
.k8s.container_id |
Container log file name. |
.k8s.container_image |
python kubernetes.client.CoreV1Api. |
.k8s.container_hash |
python kubernetes.client.CoreV1Api. |
.k8s.docker_id |
python kubernetes.client.CoreV1Api. |
.k8s.labels.* |
python kubernetes.client.CoreV1Api. |
.k8s.annotations.* |
python kubernetes.client.CoreV1Api. |
Declaration
kubernetes(
base-dir("<pathname>")
);
Last modified October 29, 2023: Create manpages (#34) (9534f54)