Ship Kubernenetes events to kibana

Elastic Stack Beats
,
1

How can we ship Kubernetes events logs to kibana.
ie: That we can get from kubectl get events command.
example output:

LAST SEEN   TYPE      REASON     OBJECT                 MESSAGE
47s         Warning   Failed     pod/similar-discover   Error: ImagePullBackOff
47m         Normal    Pulling    pod/snap-to-dest-v1 	Pulling image 
2m          Warning   Failed     pod/snap-to-dest-v2    Error: ImagePullBackOff
4m55s       Warning   Failed     pod/snap-to-road-v1    Error: ImagePullBackOff

So, is there any way to incorporate Kubernetes events means starting of pods, a restart of the pod, ImagePullBackOff, this type of information can be shipped to the kibana.

Or for shipping this events logs do we have to use other member of beat rather than filebeat any suggestion or how to proceed.

Previously I have setup kubernetes logging using hints based autodiscover.
My filebeat configuration file is as follows:

filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          templates:
             - condition:
                 not:
                   equals:
                     kubernetes.container.name: filebeat
               config:
                 - type: container
                   paths:
                   - /var/log/containers/*${data.kubernetes.container.id}.log
          
    fields_under_root: true  
    logging.json: true
    logging.to_stderr: true     
    

    output.kafka:
      enabled: true
      hosts:

        - host.docker.internal:9200
      topic: "%{[kafka_topic]}"
      required_acks: 1
      max_message_bytes: 10000000

Thanks in Advance.

2

Hi @frozen_walker,

Metricbeat is able to ship Kubernetes events, just make sure you enable the kubernetes event metricset. See:

And remember to enable it by uncommenting this part:

Best regards

3

Hi, ok will give it a try using metric beat. But is there anyway to ship Kuberenetes events through filebeat, or it is not it's functionality.

Thanks in advance.

4

@exekias

5

There is no way to ship events from Filebeat, unless you have them delivered to a file (I believe there is no way to do this with Kubernetes but could be wrong)

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.