Kubernetes

A DaemonSet that collects pod logs and node events with the right metadata attached.

Run Fluent Bit as a DaemonSet with the Kubernetes filter, so every log line carries its namespace, pod and container.

kubectl create secret generic logstreem \
  --from-literal=token="$LOGSTREEM_TOKEN" \
  -n observability

Querying it

LSQL

read top to bottom

1['k8s-events']
2| where ['kubernetes.namespace_name'] == "production"
3| where log has "OOMKilled" or log has "CrashLoopBackOff"
4| summarize restarts = count() by ['kubernetes.pod_name'], ['kubernetes.container_name']
5| order by restarts desc

Turn annotations off

Annotations On attaches every pod annotation to every log line. On a cluster with a service mesh that is dozens of extra fields per event, and the fastest route to the 4,096-field cap.

PreviousFluent Bit NextAWS Lambda