<p>I have 3 kubernetes cluster and i am trying to save the output of &quot;kubectl get events --all-namespaces&quot; on hourly/daily basis.</p>
<p>Current setup:</p>
<ol>
<li>3 Azure kubernetes clusters.</li>
<li>Using &quot;filebeat&quot; to ship the logs.</li>
<li>Shipping the logs to &quot;Graylog&quot;</li>
</ol>
<p>Currently fetching the container logs on the path <code>:/var/lib/docker/containers</code></p>
<p>Please help me in finding a way to ship the output of &quot;kubectl get events --all-namespaces&quot; AND events logs on cluster level.</p>

Docgyan
<ol>
<li>Write a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/" rel="nofollow noreferrer">K8s Cronjob</a>  with a docker image with kubectl installed and runs &quot;kubectl get events -A&quot; as shown in the Dockerfile below</li>
<li>Create a service account, clusterrole, clusterrolebinding, that gives &quot;get events&quot; permissions to the service account</li>
<li>Use this service account in the cronjob manifest</li>
<li>When the job runs as scheduled, the logs of the kubectl get events will be sent to the container logs</li>
<li>Filebeat will do the rest</li>
</ol>
<p>Details on configuring a pod to run kubectl are here:</p>
<p><a href="https://itnext.io/running-kubectl-commands-from-within-a-pod-b303e8176088" rel="nofollow noreferrer">https://itnext.io/running-kubectl-commands-from-within-a-pod-b303e8176088</a></p>
<p>Dockerfile</p>
<pre><code>FROM debian:buster
RUN apt update &amp;&amp; \
      apt install -y curl &amp;&amp; \
      curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl &amp;&amp; \
      chmod +x ./kubectl &amp;&amp; \
      mv ./kubectl /usr/local/bin/kubectl
CMD kubectl get events -A
</code></pre>
