1"use strict";(self.webpackChunkkubevela_io=self.webpackChunkkubevela_io||[]).push([[1070],{2008:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/normal-log-bb5f0cf2da4a02a2e17b4d62a6d5197f.jpg"},16075:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/event-log-3209d7f217189c3ac1f5b202745e6fb6.jpg"},28453:(e,n,o)=>{o.d(n,{R:()=>l,x:()=>a});var t=o(96540);const s={},i=t.createContext(s);function l(e){const n=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),t.createElement(i.Provider,{value:n},e.children)}},36618:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>r,contentTitle:()=>a,default:()=>h,frontMatter:()=>l,metadata:()=>t,toc:()=>c});const t=JSON.parse('{"id":"platform-engineers/operations/o11y/logging","title":"Log Collection","description":"The application logs are very important for users to find and locate problems especially in production environment.","source":"@site/versioned_docs/version-v1.10/platform-engineers/operations/o11y/logging.md","sourceDirName":"platform-engineers/operations/o11y","slug":"/platform-engineers/operations/o11y/logging","permalink":"/docs/v1.10/platform-engineers/operations/o11y/logging","draft":false,"unlisted":false,"editUrl":"https://github.com/kubevela/kubevela.io/edit/main/docs/platform-engineers/operations/o11y/logging.md","tags":[],"version":"v1.10","lastUpdatedBy":"Shivin Gopalani","lastUpdatedAt":1739436291000,"frontMatter":{"title":"Log Collection"},"sidebar":"docs","previous":{"title":"Metrics Collection","permalink":"/docs/v1.10/platform-engineers/operations/o11y/metrics"},"next":{"title":"Customize Dashboard","permalink":"/docs/v1.10/platform-engineers/operations/o11y/dashboard"}}');var s=o(74848),i=o(28453);const l={title:"Log Collection"},a=void 0,r={},c=[{value:"Quick start",id:"quick-start",level:2},{value:"Enable the loki addon",id:"enable-the-loki-addon",level:3},{value:"Collecting logs by traits",id:"collecting-logs-by-traits",level:4},{value:"Collecting all STDOUT logs automatically",id:"collecting-all-stdout-logs-automatically",level:4},{value:"Enable the grafana addon",id:"enable-the-grafana-addon",level:3},{value:"Kubernetes system events logs",id:"kubernetes-system-events-logs",level:2},{value:"Collecting stdout log",id:"collecting-stdout-log",level:2},{value:"nginx access log analysis",id:"nginx-access-log-analysis",level:3},{value:"Customize log processing configuration",id:"customize-log-processing-configuration",level:3},{value:"Collecting file log",id:"collecting-file-log",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",hr:"hr",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components},{Details:t}=n;return t||function(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["The application logs are very important for users to find and locate problems especially in production environment.\nThis doc will introduce how to use ",(0,s.jsx)(n.code,{children:"loki"})," addon to collecting application logs and analysis them."]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsxs)(n.p,{children:["This section will more likely to introduce how to collect and analysis logs.\nIf you just want to get real time logs from application for debug, you can just use ",(0,s.jsx)(n.code,{children:"vela logs"})," command or check it on UI console provided by ",(0,s.jsx)(n.code,{children:"velaux"})," addon."]})}),"\n",(0,s.jsx)(n.h2,{id:"quick-start",children:"Quick start"}),"\n",(0,s.jsxs)(n.p,{children:["We need to enable the ",(0,s.jsx)(n.code,{children:"loki"})," and ",(0,s.jsx)(n.code,{children:"grafana"})," addon for this capability."]}),"\n",(0,s.jsx)(n.h3,{id:"enable-the-loki-addon",children:"Enable the loki addon"}),"\n",(0,s.jsx)(n.p,{children:"The loki addon can be enabled in two modes:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Collecting application logs by specify trait, this is the default behavior when enabling log collection."}),"\n",(0,s.jsx)(n.li,{children:"Collecting all applications logs from container stdout."}),"\n"]}),"\n",(0,s.jsx)(n.h4,{id:"collecting-logs-by-traits",children:"Collecting logs by traits"}),"\n",(0,s.jsxs)(n.p,{children:["To make this mode work, you need to enable loki addon by setting parameter ",(0,s.jsx)(n.code,{children:"agent=vector"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-shell",children:"vela addon enable loki agent=vector\n"})}),"\n",(0,s.jsx)(n.admonition,{type:"caution",children:(0,s.jsxs)(n.p,{children:["When enable loki addon without the ",(0,s.jsx)(n.code,{children:"agent"})," parameter, no log collector will be enabled, only loki service deployed."]})}),"\n",(0,s.jsxs)(n.p,{children:["After this addon enabled with ",(0,s.jsx)(n.code,{children:"agent=vector"}),", a ",(0,s.jsx)(n.a,{href:"https://github.com/grafana/loki",children:"loki"})," service will be deployed in the control plane as a log store, and a log collection agent ",(0,s.jsx)(n.a,{href:"http://ve
1ctor.dev/",children:"vector"})," will be deployed as daemon for all nodes of each current managed clusters."]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["If you want to specify the clusters, you can specify the ",(0,s.jsx)(n.code,{children:"clusters"})," parameter when enabling addon.\nWhen new cluster joined, you need to enable this addon once again to install on these newly joined ones."]})}),"\n",(0,s.jsx)(n.p,{children:"Finally, you will get the following traits for log collection."}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"file-logs"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"stdout-logs"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"One application needs to configure above trait to make the log collected. These traits can also support configuring the vector VRL configuration to perform specific parsing method on the log content. The following chapters will introduce this part in detail."}),"\n",(0,s.jsx)(n.h4,{id:"collecting-all-stdout-logs-automatically",children:"Collecting all STDOUT logs automatically"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-shell",children:"vela addon enable loki agent=vector stdout=all\n"})}),"\n",(0,s.jsxs)(n.p,{children:["After the addon enabled with ",(0,s.jsx)(n.code,{children:"stdout=all"}),", the vector agent will collect all stdout logs of application pods automatically. No additional traits need to be configured.\nThe collected logs will be delivered to the loki service in the control plane cluster for storage."]}),"\n",(0,s.jsxs)(n.admonition,{type:"caution",children:[(0,s.jsx)(n.p,{children:"The most advantage of this mode is that all logs configuration is simple and automatic, while the disadvantage are:"}),(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Collecting all running pods will ",(0,s.jsx)(n.strong,{children:"cause a lot of pressure"})," on the loki service when there are too many applications. On the one hand, not all logs are needed, it can waste disk storage a lot. On the other hand, the vector agents of each cluster need to transmit the collected logs to control plane cluster, which will consume lots of network bandwidth."]}),"\n",(0,s.jsx)(n.li,{children:"The full collection mode can only collect logs in a unified way, and no special log parsing can be done on different applications."}),"\n"]})]}),"\n",(0,s.jsx)(n.h3,{id:"enable-the-grafana-addon",children:"Enable the grafana addon"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-shell",children:"vela addon enable grafana\n"})}),"\n",(0,s.jsx)(n.admonition,{type:"caution",children:(0,s.jsxs)(n.p,{children:["Even if you have enabled the grafana addon as described in the ",(0,s.jsx)(n.a,{href:"/docs/v1.10/platform-engineers/operations/observability",children:'"Automated Observability Documentation"'}),", you still need to re-enable the addon to register the loki data source to grafana."]})}),"\n",(0,s.jsx)(n.h2,{id:"kubernetes-system-events-logs",children:"Kubernetes system events logs"}),"\n",(0,s.jsx)(n.p,{children:"After the loki addon enabled, a component will be installed in each cluster, which is responsible for collecting Kubernetes events and convert
1ing them to logs transmit to loki. You can also view and analyze the events of the system through the Kubernetes events dashboard in the grafana addon."}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"event-log",src:o(16075).A+"",width:"2488",height:"1288"})}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)(n.p,{children:"KubeVela Events dashboard"}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Kubernetes Event overview"})," Displays the number of latest Kubernetes events in each time period of the system."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Warning Events"})," The number of ",(0,s.jsx)(n.code,{children:"Warning"})," type events."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Image Pull Failed/Container Crashed .../Pod Evicted"})," The number of events that indicate application failures, such as image pull failure and pod eviction in the last 12 hours."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"TOP 10 Kubernetes Events"})," Top 10 types of events with the highest number of occurrences in the last 12 hours."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Kubernetes Events Source"})," Pie chart of the controllers producing these events."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Kubernetes Events Type"})," Pie chart of involved resource object types of events."]}),(0,s.jsx)(n.hr,{}),(0,s.jsx)(n.p,{children:"**Kubernetes Live Events ** The recent event logs."})]}),"\n",(0,s.jsx)(n.h2,{id:"collecting-stdout-log",children:"Collecting stdout log"}),"\n",(0,s.jsx)(n.p,{children:"As mentioned above, if you're not enable the stdout full collection mode, you can collect stdout logs by specify trait."}),"\n",(0,s.jsxs)(n.p,{children:["Configure the ",(0,s.jsx)(n.code,{children:"stdout-logs"})," trait in the component, as follows:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: core.oam.dev/v1beta1\nkind: Application\nmetadata:\n name: app-stdout-log\n namespace: default\nspec:\n components:\n - type: webservice\n name: comp-stdout-log\n properties:\n image: busybox\n traits:\n - type: command\n properties:\n command:\n - sh\n - -c\n - |\n while :\n do\n now=$(date +"%T")\n echo "stdout: $now"\n sleep 10\n done\n - type: stdout-logs\n'})}),"\n",(0,s.jsxs)(n.p,{children:["After the application is created, you can find the deployment resource created by the application in the application dashboard of grafana, click ",(0,s.jsx)(n.code,{children:"Detail"})," button to jump to the deployment resource dashboard, and find the log data below. as follows:"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"normal-log",src:o(2008).A+"",width:"1356",height:"301"})}),"\n",(0,s.jsx)(n.h3,{id:"nginx-access-log-analysis",children:"nginx access log analysis"}),"\n",(0,s.jsxs)(n.p,{children:["If your application is an nginx gateway, the ",(0,s.jsx)(n.code,{children:"stdout-logs"})," trait provide the capability to parse nginx ",(0,s.jsx)(n.a,{href:"https://docs.nginx.com/nginx/admin-guide/monitoring/logging/",children:"combined"})," format log to json format as follows:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"apiVersion: core.oam.dev/v1beta1\nkind: Application\nmetadata:\n name: nginx-app-2\nspec:\n components:\n - name: nginx-comp\n type: webservice\n properties:\n image: nginx:1.14.2\n ports:\n - port: 80\n expose: true\n traits:\n - type: stdout-logs\n properties:\n parser: nginx\n"})}),"\n",(0,s.jsx)(n.p,{children:"Then a special nginx access log analysis dashboard will be generated as follows:"}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"nginx-log",src:o(86347).A+"",width:"2282",height:"1222"})}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)(n.p,{children:"KubeVela nginx application dashboard"}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"KPI's"})," Contains the gateway's core key metrics, such as total request traffic in the last twelve hours, and percentage of 5xx requests."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"HTTP status statistic"})," Statistics of the number of requests for each request code."]}),(0,s.jsx)(n.hr,{}),(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Top Request Pages"})," Statistics of the most visited pages."]})]}),"\n",(0,s.jsx)(n.h3,{id:"customize-log-processing-configuration",children:"Customize log processing configuration"}),"\n",(0,s.jsx)(n.p,{children:"You can also set customize parse configuration for your application log in this trait. As follows:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: core.oam.dev/v1beta1\nkind: Application\nmetadata:\n name: nginx-app-2\nspec:\n components:\n - name: nginx-comp\n type: webservice\n properties:\n image: nginx:1.14.2\n ports:\n - port: 80\n expose: true\n traits:\n - type: stdout-logs\n properties:\n parser: customize\n VRL: |\n .message = parse_nginx_log!(.message, "combined")\n .new_field = "new value"\n'})}),"\n",(0,s.jsxs)(n.p,{children:["In this example, we transform nginx ",(0,s.jsx)(n.code,{children:"combinded"})," format logs to json format, and adding a ",(0,s.jsx)(n.code,{children:"new_field"})," json key to each log, the json value is ",(0,s.jsx)(n.code,{children:"new value"}),". Please refer to ",(0,s.jsx)(n.a,{href:"https://vector.dev/docs/reference/vrl/",children:"document"})," for how to write vector VRL."]}),"\n",(0,s.jsxs)(n.p,{children:["If you have a special log analysis dashboard for this processing method, you can refer to ",(0,s.jsx)(n.a,{href:"/docs/v1.10/platform-engineers/operations/o11y/dashboard",children:"document"})," to import it into grafana."]}),"\n",(0,s.jsx)(n.h2,{id:"collecting-file-log",children:"Collecting file log"}),"\n",(0,s.jsx)(n.p,{children:"The loki addon also support to collect file logs of containers. It doesn't matter with which mode you're enabling the loki addon, it works for all modes. Use the trait as follows:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: core.oam.dev/v1beta1\nkind: Application\nmetadata:\n name: app-file\n namespace: default\nspec:\n components:\n - type: webservice\n name: file-log-comp\n properties:\n image: busybox\n traits:\n - type: command\n properties:\n command:\n - sh\n - -c\n - |\n while :\n do\n now=$(date +"%T")\n echo "file: $now" >> /root/verbose.log\n sleep 10\n done\n - type: file-logs\n properties:\n path: /root/verbose.log\n'})}),"\n",(0,s.jsxs)(n.p,{children:["In the example, we let business log of the ",(0,s.jsx)(n.code,{children:"my-biz"})," component write to the ",(0,s.jsx)(n.code,{children:"/data/daily.log"})," path in the container. After the application is created, you can view the corresponding file log results through the ",(0,s.jsx)(n.code,{children:"deployment"})," dashboard."]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsx)(n.p,{children:"It should be noted that the logs that need to be collected mustn't is in the root directory of the container, otherwise it may cause the container to fail to start."})})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},86347:(e,n,o)=>{o.d(n,{A:()=>t});const t=o.p+"assets/images/nginx-log-42a193ea0fdfc1a59d07521d8bad4d61.jpg"}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.