<p>I run new modules of my system in Google-Container-Engine. I would like to bring stdout and stderr from them (running in pods) to my centralised logstash. Is there an easy way to forward logs from pods to external logging service, e.g., logstash or elasticsearch?</p>

<p>I decided to log directly to <em>elasticsearch</em>, an external virtual machine that can be access at <code>elasticsearch.c.my-project.internal</code> (I am on Google-Cloud-Platform). It is quite easy:</p>
<ol>
<li><p>Setup an ExternalService with name: <em>elasticsearch</em> that points to the elasticsearch instance:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: elasticsearch-logging
  namespace: kube-system
  labels:
    k8s-app: elasticsearch
    kubernetes.io/name: &quot;elasticsearch&quot;
spec:
  type: ExternalName
  externalName: elasticsearch.c.my-project.internal
  ports:
    - port: 9200
      targetPort: 9200
</code></pre>
</li>
<li><p>Deploy a fluentd-elasticsearch as a DeamonSet. fluentd-elasticsearch will automatically connect to service with name <code>elasticsearch-logging</code> (based on a <a href="https://github.com/kubernetes/kubernetes/blob/master/cluster/saltbase/salt/fluentd-es/fluentd-es.yaml" rel="nofollow noreferrer">fluentd-elasticsearch deployment defintion</a> :</p>
<pre><code>apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: fluentd-elasticsearch
  namespace: kube-system
  labels:
    tier: monitoring
    app: fluentd-logging
    k8s-app: fluentd-logging
spec:
  template:
    metadata:
      labels:
        name: fluentd-elasticsearch
    spec:
      containers:
        - name: fluentd-elasticsearch
          image: gcr.io/google_containers/fluentd-elasticsearch:1.19
          volumeMounts:
          - name: varlog
            mountPath: /var/log
          - name: varlibdockercontainers
            mountPath: /var/lib/docker/containers
            readOnly: true
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
</code></pre>
</li>
</ol>
<p>Use <code>kubectl logs fluentd-elasticsearch-...</code> to check whether you were able to connect to the elasticsearach instance.</p>
<ol start="3">
<li>Now, you can access kibana and see the logs.</li>
</ol>
