

The following document focus on how to deploy Fluentd in Kubernetes and extend the possibilities to have different destinations for your logs.

Getting Started


Before to get started, make sure you understand or have a basic idea about the following concepts from Kubernetes:

  • Node


  • Pod


  • DaemonSet


Since applications runs in Pods and multiple Pods might exists across multiple nodes, we need a specific Fluentd-Pod that takes care of log collection on each node: Fluentd DaemonSet.

Fluentd DaemonSet


Fluentd is flexible enough and have the proper plugins to distribute logs to different third party applications like databases or cloud services, so the principal question is to know: where the logs will be stored ?. Once we got that question answered, we can move forward configuring our DaemonSet.

The below steps will focus on sending the logs to a Elasticsearch Pod.

Get Fluentd DaemonSet sources

We have created a Fluentd DaemonSet that have the proper rules and container image ready to get started:



DaemonSet Content



Logging to Elasticsearch



As an example let's see a part of the file content:

apiVersion: extensions/v1beta1
kind: DaemonSet
name: fluentd
namespace: kube-system
- name: fluentd
image: quay.io/fluent/fluentd-kubernetes-daemonset
value: "elasticsearch-logging"
value: "9200"

The Yaml file have two relevant environment variables that are used by Fluentd when the container starts:

Environment Variable Description Default

FLUENT_ELASTICSEARCH_HOST Specify the host name or IP address. elasticsearch-logging FLUENT_ELASTICSEARCH_PORT Elasticsearch TCP port 9200

Any relevant change needs to be done to the Yaml file before to deploy it. Using the default values assumes that at least an Elasticsearch Pod elasticsearch-logging exists in the cluster.
