# Ship Kubernenetes events to kibana

**URL:** <https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389>\
**Category:** Beats\
**Tags:** filebeat, metricbeat\
**Created:** [April 27, 2021, 1:53pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389 "2021-04-27T13:53:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![frozen\_walker](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@frozen\_walker](https://discuss.elastic.co/u/frozen_walker)\
**Post date:** [April 27, 2021, 1:53pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/1 "2021-04-27T13:53:37Z")

</div>

How can we ship Kubernetes events logs to kibana.  
ie: That we can get from `kubectl get events` command.  
example output:

```auto
LAST SEEN TYPE REASON OBJECT MESSAGE
47s Warning Failed pod/similar-discover Error: ImagePullBackOff
47m Normal Pulling pod/snap-to-dest-v1 Pulling image 
2m Warning Failed pod/snap-to-dest-v2 Error: ImagePullBackOff
4m55s Warning Failed pod/snap-to-road-v1 Error: ImagePullBackOff

```

So, is there any way to incorporate Kubernetes events means **starting of pods, a restart of the pod, ImagePullBackOff,** this type of information can be shipped to the kibana.

Or for shipping this events logs do we have to use other member of beat rather than filebeat any suggestion or how to proceed.

Previously I have setup kubernetes logging using hints based autodiscover.  
My filebeat configuration file is as follows:

```auto
filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          templates:
             - condition:
                 not:
                   equals:
                     kubernetes.container.name: filebeat
               config:
                 - type: container
                   paths:
                   - /var/log/containers/*${data.kubernetes.container.id}.log
          
    fields_under_root: true  
    logging.json: true
    logging.to_stderr: true     
    

    output.kafka:
      enabled: true
      hosts:

        - host.docker.internal:9200
      topic: "%{[kafka_topic]}"
      required_acks: 1
      max_message_bytes: 10000000

```

Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [April 27, 2021, 2:15pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/2 "2021-04-27T14:15:10Z")

</div>

Hi @frozen_walker,

Metricbeat is able to ship Kubernetes events, just make sure you enable the `kubernetes` `event` metricset. See:

> **[Run Metricbeat on Kubernetes | Metricbeat Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html)**

And remember to enable it by uncommenting this part:

> <https://github.com/elastic/beats/blob/08b015978af87cf3be96c2f4b929d1081e9a9692/deploy/kubernetes/metricbeat-kubernetes.yaml#L48-L51>

Best regards

---

<div class="post-metadata">

**Author:** ![frozen\_walker](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@frozen\_walker](https://discuss.elastic.co/u/frozen_walker)\
**Post date:** [April 27, 2021, 2:53pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/3 "2021-04-27T14:53:56Z")

</div>

Hi, ok will give it a try using metric beat. But is there anyway to ship Kuberenetes events through filebeat, or it is not it's functionality.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![frozen\_walker](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@frozen\_walker](https://discuss.elastic.co/u/frozen_walker)\
**Post date:** [April 27, 2021, 2:56pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/4 "2021-04-27T14:56:00Z")

</div>

@exekias

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [April 27, 2021, 3:09pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/5 "2021-04-27T15:09:34Z")

</div>

There is no way to ship events from Filebeat, unless you have them delivered to a file (I believe there is no way to do this with Kubernetes but could be wrong)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2021, 5:09pm UTC](https://discuss.elastic.co/t/ship-kubernenetes-events-to-kibana/271389/6 "2021-05-25T17:09:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.