Send Kubernetes pod's logs to Splunk

4/9/2020

I am using Amazon EKS and I have a server (consider it as X ) which is connected to the control node using kubectl.

I am able to get the pod logs from the server X by running the following command. kubectl logs -f podname -n=namespace

Now my goal is to send these pod logs to Splunk for which I am using splunk-connect-for-kubernetes

But as per the configurations of values.yaml file, kubernetes logs are forwarded to the Splunk instead of the pod logs.

I would specifically like to send the pod logs i.e. my application logs to the Splunk. Is there any way to achieve this?

-- Shreeya Patel
amazon-eks
fluentd
kubernetes
kubernetes-helm
splunk

1 Answer

4/9/2020

One of the option you have is to make use of fluentd, fluentbit combination to read and send to splunk.

-- Bimal
Source: StackOverflow