Configuring LogSources for Kubernetes Event Logging

Last updated on 22 November, 2022

With LogSources you can view and configure log integrations in the LogicMonitor portal. LogSources provides out-of-the-box setup and configuration for some popular logsources. This article describes specific configuration options when setting up LogSources for Kubernetes Events Logging types of resources.

Creating LogSources

LogSources are created from Settings in the LM portal. For general information on how to add a logsource, see Creating LogSources.

Configuration Options

The Kubernetes Events Logging log resource type uses the LM Collector. This runs on a Linux or Windows server within the infrastructure and uses standard monitoring protocols to monitor devices. The following describes specific configuration options for the Kubernetes Events Logging type of logsource.

Include Filters

You can add filters to specifically include resources of certain types, for example an application.

Available parameters

AttributesComparison OperatorValue
MessageEqual, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch.
ReasonEqual, NotEqual, Contain, NotContain, RegexMatch, RegexNotMatch.
TypeEqual, NotEqual.Normal, Warning.

Parameter explanation

  • Reason: Free text possible as list is too long. See Kubernetes for examples of event reasons.
  • Type: Options are “Normal” and “Warning”. See Kubernetes for valid event types. A missing “Type” filter means including both “Normal” and “Warning” types.

Log Fields/Tags

You can configure Log Fields/Tags to include additional metadata to be sent with the logs.

Available parameters

MethodKeyValue
StaticFor example “Customer”For example “Customer_XYZ”
Dynamic(REGEX)For example “Host”For example “host=*”
LM Property(Token)For example “Device”For example “##system.deviceId##”
Kubernetes AttributeType, Reason.

Parameter explanation

  • Dynamic(REGEX): The query will run on the message field.

Example

Configuration example for a Kubernetes Event Logging type of logsource.

General Information

  • Name: Kubernetes_Events
  • Description: Data collection template for event logs from monitored Kubernetes clusters.
  • AppliesTo (custom query): system.devicetype == “8” 
  • Type: LM Logs: Kubernetes Event Logging
  • Group: Kubernetes

Log Fields/Tags

MethodKeyValue
AttributeKubernetes_ReasonReason
AttributeEvent_typeType
In This Article