https://rancher.com/ logo
Title
h

hallowed-breakfast-56871

05/08/2022, 11:12 PM
Hey folks - Anyone got filebeat working with collecting pod logs with RKE2? I see logs are placed / setup differently on RKE2 so this means filebeat gets confused with this logs belongs to which pod. https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html
c

creamy-pencil-82913

05/08/2022, 11:15 PM
The pod logs should all be in the normal place that the kubelet puts them... /var/log/pods and /var/log/containers ?
h

hallowed-breakfast-56871

05/08/2022, 11:16 PM
Yes, the issue is the naming conventions and extra subfolders used I think
for example
/var/log/pods/mysql_mysql-7885d65449-w45jv_c4fd04a8-6cde-4245-8f92-ced215521c48/mysql/0.log
Its not using the container ID, so I think filebeat gets confused.
I can of course change the pathings, and that does work, but then the logs are not correctly associated with the pod the generated them... as there is no ID to match to.
/var/log/containers
is just symlinks on a RKE2 server
c

creamy-pencil-82913

05/08/2022, 11:36 PM
That's the standard location for the kubelet as far as I know, it's not custom to k3s or rke2 but it may be different than when the kubelet uses the legacy dockershim?