How to forward Kubernetes events with the rancher-logging chart

• Rancher v2.5+
• A Rancher-managed cluster with rancher-logging installed

This article details how to configure Kubernetes event forwarding with rancher-logging.

Rancher logging supports forwarding Kubernetes events, via the logging-operator Event Tailer extension. The steps below detail how to enable the Event Tailer extension, and forward the events.

1. Create the EvenTailer resource: The EventTailer resource creates a Pod that listens for Kubernetes events and writes them to stdout, enabling their collection and forwarding by the logging-operator's fluentbit and fluentd processes.

   apiVersion: logging-extensions.banzaicloud.io/v1alpha1
   kind: EventTailer
   metadata:
     name: cluster
   spec:
     controlNamespace: cattle-logging-system
   

2. Create a Flow resource: A Flow is a namespaced resource that uses filters and selectors to route log messages to the appropriate output. In this instance the Kubernetes event logs generated by the cluster EventTailer above will be routed to the cluster-event-output.

   apiVersion: logging.banzaicloud.io/v1beta1
   kind: Flow
   metadata:
     name: eventtailer-flow
     namespace: cattle-logging-system
   spec:
     filters:
     - tag_normaliser: {}
     localOutputRefs:
     - cluster-event-output
     match:
     - select:
         labels:
           app.kubernetes.io/instance: cluster-event-tailer

3. Create an Output resource: An Output is a namespaced resource that defines where the log messages are sent. In this instance, the logs are sent to an Elasticsearch instance. Configure the Output to match your logging endpoint, per the Rancher Logging documentation.

   apiVersion: logging.banzaicloud.io/v1beta1
   kind: Output
   metadata:
     name: cluster-event-output
     namespace: cattle-logging-system
   spec:
     elasticsearch:
       host:"IP or elastic hostname"
       port: 9200
       scheme: http