DevOps with Kubernetes - Second Edition

Collecting logs with a logging agent per node

We know that messages we retrieved via kubectl logs are streams redirected from the stdout/stderr of a container, but it's obviously not a good idea to collect logs with kubectl logs. In fact, kubectl logs gets logs from kubelet, and kubelet aggregates logs from the container runtime underneath the host path, /var/log/containers/. The naming pattern of logs is {pod_name}_{namespace}_{container_name}_{container_id}.log.

Therefore, what we need to do to converge the standard streams of running containers is to set up logging agents on every node and configure them to tail and forward log files under the path, as shown in the following diagram:

In practice, we'd also configure the logging agent ...