Search code examples
loggingkubernetesfluentdefk

How is K8S_HOST_URL used and what needs it in EFK


Question

What is the purpose of the K8S_HOST_URL configuration parameter in EFK? In EFK, K8S_HOST_URL exists as an environment variable and it looks being used to communicate to the Kubernetes API server by fluentd as being specified in the filter-k8s-meta.conf of the fluentd configuration.

Looking for the documentation but not in the OpenShift Aggregating Container Logs documentation. Searched in Google but could not find a definite answer.

Please suggest the documentation which explains in detail.


Solution

  • First "K8S_HOST_URL" does not show up in elastic/elasticsearch, fluent/fluentd or elastic/kibana (the 3 projects from "EFK")

    It does show up only in openshift/origin-aggregated-logging, which is the repo with the image definitions for the components of the logging stack as well as tools for building and deploying them.

    So this seems to be how Openshift deploys its stack (through Kubernetes), which it will monitor (see "Collect and store Kubernetes events")

    See also "mux-logging service" (still from openshift/origin-aggregated-logging):

    Fluentd gets Kubernetes metadata to enrich each container log message with the namespace UUID, the pod UUID, and pod labels and annotations.