<p>I have created a custom Splunk forwarder image.</p>

<p>Image name: <code>vrathore/splunkuniversalforwarder</code></p>

<p>I have verified that the log is pushing to the server. I am using dummy log present in my host (<code>c/Users/var/log</code>). If I run this Docker command:</p>

<pre><code>docker run --name splunkforwarder -d -v /c/Users/var/log://var/log/messages -p 8089:8089 -p 8088:8088 -e SPLUNK_SERVER_HOST=splunk-prodtest-gsp.test.com:9997 -e
FORWARD_HOSTNAME=kubernetes vrathore/splunkuniversalforwarder
</code></pre>

<p>Now I wanted to use the same image in Kubernetes pod, where 2 container will share their log folder with my Splunk forwarder image.</p>

<pre><code>spec:
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
      maxSurge: 10%
  replicas: 1
  template:
    metadata:
      name: %APP_FULL_NAME%-pod
      labels:
        appname: %APP_FULL_NAME%
        stage: %APP_ENV%
        component: app-kube-pod-object
    spec:
      containers:
      - name: %APP_FULL_NAME%-service
        image: %DOCKER_IMAGE%
        imagePullPolicy: Always
        envFrom:
        - configMapRef:
            name: %APP_CONFIG_MAP%
        command: ["catalina.sh", "run"]
        ports:
        - containerPort: 8080
      imagePullSecrets:
      - name: %DOCKER_REPO_REGKEY%
  selector:
    matchLabels:
      appname: %APP_FULL_NAME%
      stage: %APP_ENV%
</code></pre>

<p>Kubernetes is new to me. How can I share the log folder between the containers?</p>

gamechanger17
<p>You need to define an emptyDir type volume and attach it to both containers. Assuming that the logs from the app are under <code>/var/log/myapp/</code> (I have added the second container as well)</p>

<pre><code>spec:
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
      maxSurge: 10%
  replicas: 1
  template:
    metadata:
      name: %APP_FULL_NAME%-pod
      labels:
        appname: %APP_FULL_NAME%
        stage: %APP_ENV%
        component: app-kube-pod-object
    spec:
      containers:
      - name: %APP_FULL_NAME%-service
        image: %DOCKER_IMAGE%
        imagePullPolicy: Always
        envFrom:
        - configMapRef:
            name: %APP_CONFIG_MAP%
        command: ["catalina.sh", "run"]
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: logs
          mountPath: /var/log/myapp/
      - name: uf
        image: vrathore/splunkuniversalforwarder
        ...
        volumeMounts:
        - name: logs
          mountPath: /var/log/myapp/
      imagePullSecrets:
      - name: %DOCKER_REPO_REGKEY%
      volumes:
      - name: logs
        emptyDir: {}
  selector:
    matchLabels:
      appname: %APP_FULL_NAME%
      stage: %APP_ENV%
</code></pre>

<p>Also, I would recommend looking for an alternative solution, with Collectord and Monitoring Kubernetes/OpenShift you can tell Collectord where to look for logs and you don't need to run a sidecar container <a href="https://www.outcoldsolutions.com/docs/monitoring-kubernetes/v5/annotations/#application-logs" rel="nofollow noreferrer">https://www.outcoldsolutions.com/docs/monitoring-kubernetes/v5/annotations/#application-logs</a>, just one Collectord daemon will do the work.</p>
