Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch container logs input to /var/log/pod/* path #12500

Closed

Conversation

pchila
Copy link
Member

@pchila pchila commented Jan 28, 2025

Proposed commit message

This PR changes the input definition for ingesting k8s container logs from /var/log/containers/* to /var/log/pods/* which contains all available logs (including rotated ones) for pods running on the k8s node.

Before this change the integration would configure the elastic-agent input using the currently running container id and locating the corresponding log file under /var/log/containers/* which would point to the current log file, ignoring previously rotated log files for the container.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@pchila pchila added Integration:kubernetes Kubernetes Team:Elastic-Agent Label for the Agent team Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team bugfix Pull request that fixes a bug issue labels Jan 28, 2025
@pchila pchila self-assigned this Jan 28, 2025
@pchila pchila force-pushed the switch-k8s-integration-to-pod-logfiles branch from 408e1e9 to 7fa7b6f Compare January 28, 2025 14:26
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @pchila

@andrewkroh andrewkroh added Integration:1password 1Password Integration:abnormal_security Abnormal Security New Integration Issue or pull request for creating a new integration package. and removed Integration:kubernetes Kubernetes Integration:1password 1Password Integration:abnormal_security Abnormal Security labels Feb 4, 2025
@qcorporation qcorporation force-pushed the main branch 2 times, most recently from eda4138 to f728ca7 Compare February 5, 2025 22:00
@pchila pchila closed this Feb 7, 2025
@pchila pchila force-pushed the switch-k8s-integration-to-pod-logfiles branch from 7fa7b6f to 51bce46 Compare February 7, 2025 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Pull request that fixes a bug issue Integration:abnormal_security Abnormal Security Integration:1password 1Password New Integration Issue or pull request for creating a new integration package. Team:Elastic-Agent Label for the Agent team Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[k8s provider] Look up metadata based on file path
3 participants