Configure Log Management for Kubernetes

Log Management is a configurable feature that can be enabled or disabled at the client level through the portal.

Prerequisites

To use Log Management, the Log Management option must be enabled. This can be done either during client creation or after the client has been created:

Note

Enabling Log Ingestion for all agents allows logs from all installed agents within the current client to be collected.

Configuration

By default, the agent will collect all pod logs and export them to OpsRamp if enableLogManagement is set to TRUE in the manifest file and Enable Log Management is set to Yes on the client details page.

Custom Configuration

For users who wish to customize log collection, the ConfigMap opsramp-pod-logs-user-config is available in the agent-installed namespace and supports various configurations.

Default ConfigMap

The default ConfigMap allows users to edit settings for log customization later without any initial modifications.

To list the default ConfigMap, use the following command:

kubectl get configmap opsramp-logs-user-config -n <agent-installed-namespace>

The manifest will appear as follows:

apiVersion: v1
kind: ConfigMap
metadata:
  name: "opsramp-logs-user-config"
  labels:
    app: "opsramp-logs-user-config"
  namespace: <agent-installed-namespace>
data:
  logsConfig.yaml: |
    pods:
      additional_labels:   
      namespaces:
        include: 
        is_include_regex: false
        exclude: 
        is_exclude_regex: false
      log_level: "Unspecified"

Additional Labels

Under additional_labels, users can specify key-value pairs that will be added as attributes to each log record. To edit the ConfigMap, use:

kubectl edit configmap opsramp-logs-user-config -n <agent-installed-namespace>

Example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: "opsramp-logs-user-config"
  labels:
    app: "opsramp-logs-user-config"
  namespace: <agent-installed-namespace>
data:
  logsConfig.yaml: |
    pods:
      additional_labels:  
        app: nginx
        env: staging

Note

Here, app: nginx and env: staging are additional labels which will be attached to every log record attribute.

Namespace Filtering

By default, the agent will collect pod logs in all namespaces. Suppose the user wants to have logs of only a few namespaces. In that case, the user has to specify inclusion or exclusion rules on namespaces by editing the opsramp-pod-logs-user-config ConfigMap.

kubectl edit configmap opsramp-logs-user-config -n <agent-installed-namespace>

Example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: "opsramp-logs-user-config"
  labels:
    app: "opsramp-logs-user-config"
  namespace: <agent-installed-namespace>
data:
  logsConfig.yaml: |  
    pods: 
      namespaces:
          include: 
            - ^monitoring
          is_include_regex: true
          exclude: 
            - monitoring-test
          is_exclude_regex: false

Note

The include and exclude fields can accept either a string or a regex pattern as a namespace.
If a user specifies a regex pattern for a namespace in the include/exclude field, the corresponding flags is_include_regex or is_exclude_regex must be set to true.
If a user specifies a namespace that is not a regex pattern in the include/exclude field, the flags is_include_regex and is_exclude_regex must be set to false.
For example, the agent collects logs of pods in all namespaces that start with monitoring but excludes logs from pods in the monitoring-test namespace.

Use Case:

Inclusion	Exclusion	Result
Not set	Not set	Logs of all namespaces will be collected
Some filter	Not set	Logs of namespaces that match the inclusion filter
Not set	Some filter	Logs of all namespaces except those that match the exclusion filter
Some filter	Some filter	Logs of namespaces that match the inclusion filter minus logs that match the exclusion filter

Use Case	Inclusion	Exclusion
Collects logs of a single namespace " agent."	include: agent is_include_regex: false	-
Collect logs of all namespaces which starting with test only	include: ^test is_include_regex: true	-
Collects logs of all namespaces except the "kube-system" namespace	-	exclude: kube-system is_exclude_regex: false
Collects logs of all namespaces except namespace ending with the name " system."	-	exclude: system$ is_exclude_regex: true
Collects logs of all namespaces starting with test or kube.	include: ^test\|^kube is_include_regex: true	-
Collects logs of all namespaces which start with test or kube but exclude testing or kube-system namespaces	include: ^test\|^kube is_include_regex: true	exclude: testing, kube-system is_exclude_regex: false
Collects logs of namespaces which end with "agent" but excludes any namespace starting with opsramp	include: agent$ is_include_regex: true	exclude: ^opsramp is_exclude_regex: true

Log-Level Filtering

Log severity levels are prioritized as follows: Fatal > Error > Warn > Info > Debug > Trace > Unspecified/Unknown. By default, all logs are sent based on this hierarchy. To filter logs by severity, specify a log level in the configuration:

Example-1:

log_level: Warn

Example-2:

log_level: Info

Note

The user has to specify the value of the log_level flag from the list mentioned in line 1, i.e. Fatal, Error, Warn, Info, Debug, and Trace

View Logs in OpsRamp Portal

Users can view logs in the OpsRamp portal from Infrastructure > Logs.

Default Logs Screen: Access your logs through the Logs UI.
Logs Filter: Click on +FILTER to select resource types and operators (e.g., Equals, Regex Not Contains).
Live Tail: Click on LIVE TAIL to view real-time logs.
Log Details: Click on any log entry for detailed information.

Once you edit the K8s ConfigMap and apply it to your cluster, the OpsRamp Agent will pick up the latest configuration changes within a few minutes. This version organizes the content into clear sections and uses straightforward language for better understanding.