<p>We need to send large (very) amount of logs to <code>Splunk</code> server from only <strong>one k8s pod</strong>( pod with huge traffic load), I look at the docs and found this:</p>
<p><a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/#sidecar-container-with-a-logging-agent" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/cluster-administration/logging/#sidecar-container-with-a-logging-agent</a></p>
<p>However, there is a <strong>Note in the docs, that is stating about a significant resource consumption</strong>. Is there any other option to do it? I mean more efficient ? As these pods handle traffic and we cannot add the additional load, that can risk it stability...</p>

<p>There's an official solution to get Kubernets logs: Splunk Connect for Kubernetes. Under the hood it also uses fluentd for the logging part.</p>
<p><a href="https://github.com/splunk/splunk-connect-for-kubernetes" rel="nofollow noreferrer">https://github.com/splunk/splunk-connect-for-kubernetes</a></p>
<p>You will find a sample config and a methodology to test it on microK8s first to get acquainted with the config and deployment: <a href="https://mattymo.io/deploying-splunk-connect-for-kubernetes-on-microk8s-with-helm/" rel="nofollow noreferrer">https://mattymo.io/deploying-splunk-connect-for-kubernetes-on-microk8s-with-helm/</a></p>
<p>And if you only want logs from a specific container you can use this section of the values file to select only logs from the container you're interested in:</p>
<pre><code>  fluentd:
    # path of logfiles, default /var/log/containers/*.log
    path: /var/log/containers/*.log
    # paths of logfiles to exclude. object type is array as per fluentd specification:
    # https://docs.fluentd.org/input/tail#exclude_path
    exclude_path:
    #  - /var/log/containers/kube-svc-redirect*.log
    #  - /var/log/containers/tiller*.log
    #  - /var/log/containers/*_kube-system_*.log (to exclude `kube-system` namespace)
</code></pre>
