Tail arbitrary host file in /var/log ? about kube-fluentd-operator HOT 2 CLOSED

Hi @lemaral,

The recommended way to do so is at the kube-system namespace level. It is not processed/validated so there you can tail arbitrary log files in /var/log (any folder indeed but the /var/log is already mounted on the pod so less work for you).

I recommend you enable json-formatted audit logs. Then add this to the kube-system's config-map:

<source>
  @type tail
  multiline_flush_interval 5s
  path /var/log/kube-apiserver-audit.log
  pos_file /var/log/xxxxx # it's important you pick a location under /var/log/
  tag k8s.audit

  <parse>
    @type       json
    time_key    timestamp
    time_format %iso8601
  </parse>
</source>

Then you can <match k8s.audit> and send your logs to an external log aggregator.

from kube-fluentd-operator.

Hi @jvassev
This works perfectly :)
Thank you very much for log-router and the detailed answer.

from kube-fluentd-operator.