Docker & Kubernetes
Centralized logging
Learn the centralized logging concept.
Centralized logging
kubectl logs is enough for a single pod, but it's useless across hundreds of pods, for deleted pods and for events from days ago. Centralized logging gathers all container logs in one place, stores them and makes them searchable. A typical pipeline has three parts:
- Collector (a DaemonSet on every node): Fluent Bit, Fluentd, Promtail, Vector
- Store and search: Elasticsearch/OpenSearch or Grafana Loki
- Interface: Kibana/OpenSearch Dashboards or Grafana
node: /var/log/containers/*.log ─► Fluent Bit (DaemonSet) ─► Elasticsearch ─► Kibana
Structured logging
Applications should write their logs to stdout, preferably in JSON format. That way the collector parses the fields (level, request ID, user) and they can be filtered in queries:
# plain text: hard to search
2026-11-03 10:12:01 ERROR sepet kaydedilemedi kullanici=42
# JSON: separate fields
{"zaman":"2026-11-03T10:12:01Z","seviye":"error","mesaj":"sepet kaydedilemedi","kullanici":42,"istek_id":"a1b2c3"}
Giving each request an ID and writing it in every service's log makes it possible to follow a request across services.
Exercise Look at the log source
Write two commands: open an interactive debug session targeting the worker-1 node with the busybox:1.36 image (kubectl debug node/worker-1 -it --image=busybox:1.36); then show the last 3 log lines of the pods labelled app=api with prefixes.
Show example solution
kubectl debug node/worker-1 -it --image=busybox:1.36
kubectl logs -l app=api --tail=3 --prefix
Test yourself
-
Why does the collector run as a DaemonSet?
- For less memory
- Because Elasticsearch requires it
- Because one copy is enough
- To read each node's container log files on that node
Show answer
To read each node's container log files on that node — The kubelet keeps logs on the node's disk.
-
Complete the path of the container log files.
node: /var/log/____/*.log
Show answer
node: /var/log/containers/*.log
-
Match.
- Fluent Bit
- Collector
- Elasticsearch
- Store and search
- Kibana
- Interface
- JSON log
- Parsable fields
Next lesson: Fluentd
