<h1>Question</h1>
<p>Are there known available Fluentd daemonset for <strong>journald docker logging driver</strong> so that I can send K8S pod logs to Elasticsearch?</p>
<h2>Background</h2>
<p>As in <a href="https://github.com/kubernetes/kubernetes/pull/42470" rel="nofollow noreferrer">add support to log in kubeadm</a>, the default logging driver for K8S installed by kubeadm is journald.</p>
<blockquote>
<p>the community is collectively moving away from files on disk at every place possible in general, and this would unfortunately be a step backwards. ...</p>
<p>You can edit you /etc/docker/daemon.json to set its default log to json files and set a max size and max files to take care of the log rotation. After that, logs wont be written to journald and you will be able to send your log files to ES.</p>
</blockquote>
<p>However, the <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch" rel="nofollow noreferrer">K8S EFK addon</a> and <a href="http://Kubernetes%20Logging%20with%20Fluentd" rel="nofollow noreferrer">Fluentd K8S</a> or <a href="https://coreos.com/tectonic/docs/latest/admin/logging.html" rel="nofollow noreferrer">Aggregated Logging in Tectonic</a> still expect to look for files in /var/log/containers in the host, if I understood correctly.</p>
<p>It looks <a href="https://github.com/emacski/k8s-fluentd" rel="nofollow noreferrer">Alternative fluentd docker image designed as a drop-in replacement for the fluentd-es-image</a> looks to be adopting journald driver. However could not make it run the pods.</p>

<p>docker log driver <code>journald</code> send docker logs to <code>systemd-journald.service</code></p>
<p>so, we need to make <code>systemd-journald</code> persistent save to <code>/var/log/journal</code></p>
<p>edit <code>/etc/systemd/journald.conf</code>:</p>
<pre><code>...
[Journal]
Storage=persistent
#Compress=yes
...
</code></pre>
<p>then restart to apply changes:</p>
<pre class="lang-sh prettyprint-override"><code>systemctl restart systemd-journald
ls -l /var/log/journal
</code></pre>
<p>as <code>/var/log</code> has been mounted into fluentd pod, its all done, restart fluentd pod it works for me @202104.</p>
<p>by the way, i am using fluentd yaml from:</p>
<ul>
<li><a href="https://github.com/fluent/fluentd-kubernetes-daemonset/blob/master/fluentd-daemonset-elasticsearch-rbac.yaml" rel="nofollow noreferrer">https://github.com/fluent/fluentd-kubernetes-daemonset/blob/master/fluentd-daemonset-elasticsearch-rbac.yaml</a></li>
</ul>
<p>and the env <code>FLUENTD_SYSTEMD_CONF</code> value should not be <code>disable</code></p>
