<p>I know docker has options like syslog <code>log-driver</code> and <code>log-opts</code> so that it can be used to send the logs to say, the UDP server.</p>
<p>Marathon is the docker orchestrator here and a config file has the below:</p>
<pre><code>    {
      &quot;key&quot;: &quot;log-driver&quot;,
      &quot;value&quot;: &quot;syslog&quot;
    },
    {
      &quot;key&quot;: &quot;log-opt&quot;,
      &quot;value&quot;: &quot;syslog-address=udp://some-udp-server:port&quot;
    },
</code></pre>
<p>The existing setup is such that certain downstream systems/entities take the information received on this UDP server to create visualisations on Grafana.</p>
<p>How do I achieve the same in a k8s manifest file that I'm deploying via helm3? Or is there a third-party application I need to use? Basically, I want to send the logs that come in the <code>kubectl logs -f &lt;pod_name&gt;</code> command to this UDP server with minimal intrusion.  I would only like to replace this part of the flow so that I don't have to disturb any of the downstream systems.</p>

<p>As David suggested there is no option to control the log target. However as requested for log collector application writing this answer.</p>
<p>If your <strong>application</strong> is <strong>streaming</strong> the <strong>UDP</strong> logs you can use the <strong><a href="https://www.graylog.org/products/source-available/" rel="nofollow noreferrer">Graylog</a></strong> Opensource. It uses <strong>Mongo &amp; Elasticsearch</strong> as backend databases. We been using <strong>Graylog</strong> to collect logs from the application POD.</p>
<p>Now regarding the <strong>log</strong> <strong>collector</strong> for <code>kubectl logs -f &lt;POD&gt;</code> you can push all these logs from the <strong>Worker Node</strong> file system using the <strong>fluentd</strong> collector. <a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-location-node" rel="nofollow noreferrer">Log location</a> will be <code>/var/log/pods</code></p>
<p>You can use the <strong>Fluentd</strong> collector along with the <strong>Graylog</strong> Gelf UDP input</p>
<pre><code>Fluentd -&gt; pushing over gelf UDP -&gt; Graylog input saving to Elasticsearch 
</code></pre>
<p>Here is the ref you can follow : <a href="https://docs.fluentd.org/how-to-guides/graylog2" rel="nofollow noreferrer">https://docs.fluentd.org/how-to-guides/graylog2</a></p>
<p>Above example uses <strong>Graylog2</strong> now <a href="https://www.graylog.org/products/source-available/" rel="nofollow noreferrer">Graylog3</a> version is available opensource would suggest checking out that.</p>
<p>You can refer my Github repo : <a href="https://github.com/harsh4870/OCI-public-logging-uma-agent" rel="nofollow noreferrer">https://github.com/harsh4870/OCI-public-logging-uma-agent</a></p>
<p>Will get more idea about how deployment setting up log file on <strong>Node's filesystem</strong> and further it gets processed by <strong>collector</strong> although not using <strong>fluentd</strong> but just for ref.</p>
<p>Oracle <strong>OCI</strong> <strong>UMA</strong> agent also similar job like <strong>fluentd</strong> collector only, <strong>parsing</strong> &amp; <strong>pushing</strong> logs to the backend.</p>
