K8s Logs

Overview

K8s Logs collects logs from Kubernetes nodes by reading container log files directly from the host filesystem. It runs as a DaemonSet to ensure log collection from all nodes.

Supported platforms

• Kubernetes: Logs

Deployment Context

Parameter	Type	Default	Required	Description
kind	string	DaemonSet	Yes	The deployment type for this source.
log_path	string	/var/log/pods	No	Path to container log files on host nodes.
cri_type	string	containerd	No	Container runtime (docker, containerd, cri-o).
priorityClass	boolean	false	No	Enable priority class for DaemonSet pods.
priorityClassName	string	—	Conditional	Required when priorityClass = true.
apply_tolerations	boolean	false	No	Allow scheduling on master/control-plane nodes.

Basic Configuration

Parameter	Type	Default	Required	Description
include_namespaces	array	[]	No	Namespaces to include. If empty, all namespaces are included.
exclude_namespaces	array	["kube-system","kube-public","kube-node-lease"]	No	Namespaces to exclude from log collection.
exclude_container_names	array	["otc-container"]	No	Container names to exclude (e.g., sidecars).
recombine_logs	boolean	false	No	Recombine partial CRI logs into full log entries.
multiline_parsing	string	disabled	No	Multiline parsing mode (disabled, line_start_pattern, line_end_pattern).
line_start_pattern	string	—	Conditional	Required if multiline_parsing = line_start_pattern.
line_end_pattern	string	—	Conditional	Required if multiline_parsing = line_end_pattern.
start_at	string	end	No	Start reading logs from beginning or end.

Advanced Configuration

Parameter	Type	Default	Required	Description
encoding	string	utf-8	No	Log file encoding format.
poll_interval	string	200ms	No	Interval between file polling cycles.
force_flush_period	string	500ms	No	Flush partial logs after this duration.
max_log_size	string	1MiB	No	Maximum size of a single log entry.
max_concurrent_files	integer	1024	No	Max files processed in parallel.
retry_on_failure	boolean	false	No	Enable retry on export failure.
retry_on_failure_initial_interval	string	1s	Conditional	Required if retry enabled.
retry_on_failure_max_interval	string	30s	Conditional	Required if retry enabled.
retry_on_failure_max_elapsed_time	string	5m	Conditional	Required if retry enabled.

Example Configuration

{
  // Deployment Context
  "kind": "DaemonSet",
  "log_path": "/var/log/pods",
  "cri_type": "containerd",
  "priorityClass": false,
  "priorityClassName": "",
  "apply_tolerations": false,

  // Basic Configuration
  "include_namespaces": ["default", "production"],
  "exclude_namespaces": ["kube-system", "kube-public", "kube-node-lease"],
  "exclude_container_names": ["istio-proxy"],
  "recombine_logs": true,
  "multiline_parsing": "line_start_pattern",
  "line_start_pattern": "^\\d{4}-\\d{2}-\\d{2}",
  "start_at": "end",

  // Advanced Configuration
  "encoding": "utf-8",
  "poll_interval": "200ms",
  "force_flush_period": "500ms",
  "max_log_size": "1MiB",
  "max_concurrent_files": 1024,

  "retry_on_failure": true,
  "retry_on_failure_initial_interval": "1s",
  "retry_on_failure_max_interval": "30s",
  "retry_on_failure_max_elapsed_time": "5m",
}

Notes

• File-offset persistence. The K8s deployment packaging mounts a hostPath at /app/data (path on the node: /var/lib/praxis-edge-collector/<pipeline>) and sets COL_HOME=/app/data, so the filelog receiver's file_storage extension persists offsets per-node. Offsets survive collector pod replacement on the same node. The path is keyed on pipeline name only (no signal suffix), so a pipeline that flips from a split layout to the merged node-agent layout reuses the same on-disk offset DB rather than re-tailing every log file.
• DaemonSet merge. When a pipeline contains k8s_logs together with k8s_kubeletstats and/or k8s_hostmetrics, all of them are co-located in a single per-node DaemonSet (<pipeline>-node-agent) instead of separate ones. Halves per-node baseline overhead. Default on — set ADL_K8S_MERGE_NODE_AGENT=false on the cloud side to opt out. See the pipeline architecture doc for rollout posture.