<p>I have a <code>filebeat</code> configured to send my k8s cluster logs to <code>Elasticsearch</code>.<br />
When I connect to the pod directly (<code>kubectl exec -it &lt;pod&gt; -- sh -c bash</code>),<br />
the generated output logs aren't being sent to the destination.</p>
<p>Digging at k8s docs, I couldn't find how k8s is handling STDOUT from a running shell.</p>
<p>How can I configure k8s to send live shell logs?</p>

itaied
<p>Kubernetes has (mostly) nothing to do with this, as logging is handled by the container environment used to support Kubernetes, which is usually docker.</p>
<p>Depending on docker version, logs of containers could be written on json-file, journald or more, with the default being a json file. You can do a <code>docker info | grep -i logging</code> to check what is the Logging Driver used by docker. If the result is json-file, logs are being written down on a file in json format. If there's another value, logs are being handled in another way (and as there are various logging drivers, I suggest to check the documentation about them)</p>
<p>If the logs are being written on file, chances are that by using <code>docker inspect container-id | grep -i logpath</code>, you'll be able to see the path on the node.</p>
<p>Filebeat simply harvest the logs from those files and it's docker who handles the redirection between the application STDOUT inside the container and one of those files, with its driver.</p>
<p>Regarding exec commands not being in logs, this is an open proposal ( <a href="https://github.com/moby/moby/issues/8662" rel="nofollow noreferrer">https://github.com/moby/moby/issues/8662</a> ) as not everything is redirected, just logs of the apps started by the entrypoint itself.</p>
<p>There's a suggested workaround which is ( <a href="https://github.com/moby/moby/issues/8662#issuecomment-277396232" rel="nofollow noreferrer">https://github.com/moby/moby/issues/8662#issuecomment-277396232</a> )</p>
<blockquote>
<p>In the mean time you can try this little hack....</p>
<p><code>echo hello &gt; /proc/1/fd/1</code></p>
<p>Redirect your output into PID 1's (the docker container) file
descriptor for STDOUT</p>
</blockquote>
<p>Which works just fine but has the problem of requiring a manual redirect.</p>
