<p>Where are these stored? Is there a recommended way to export them for analysis purposes?</p>

<p>I'm referring to the data from <code>kubectl get events</code>.</p>

Chris Stryczynski
<blockquote>
  <p>Where are these stored?</p>
</blockquote>

<p>If you run <code>kubectl get events --v=9</code> you will observe that there is actual api call behind it:</p>

<pre><code>GET /api/v1/namespaces/default/events?limit=500
</code></pre>

<p>You can use api to extract details as described in <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.10/#-strong-read-operations-strong--289" rel="nofollow noreferrer">the official documenatation</a>.</p>

<p>As for storage, they are kept in etcd cluster. As an excerpt from <a href="https://github.com/kubernetes/kubernetes/issues/47532" rel="nofollow noreferrer">discussion about events</a> here is relevant part to your question:</p>

<pre><code>Kubernetes only use etcd's lease API for creating event objects.
Event objects' lease lasts for 1 hour and doesn't need good precision.
</code></pre>

<p>You now have two paths around this:</p>

<ul>
<li>pull events using api (I'd probably do this for analysis purposes since this is what actually gets relayed by <code>kubectl</code> command)</li>
<li>query etcd cluster (if you want more granular control over data processing)</li>
</ul>
