Container Service for Kubernetes:Collect logs using a sidecar

Prerequisites

Before you begin, ensure that you have:

• An ACK Serverless cluster. For details, see Create a cluster.

• Simple Log Service activated. To activate it, log on to the Simple Log Service console and follow the on-screen instructions.

How it works

The Logtail sidecar runs as an independent log agent inside each ECI instance. It shares a log folder with the application container through a Kubernetes volume. The application container writes logs to that folder, and Logtail monitors and collects the log files, then sends them to SLS.

Two log types are supported:

Step 1: Deploy the sidecar container

Create a Deployment that includes both the application container and the Logtail sidecar container.

The sample YAML below uses an nginx log generator as the application container and mounts both volume types. Replace the placeholder values before applying.

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-log-sidecar-demo
  name: nginx-log-sidecar-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-log-sidecar-demo
  template:
    metadata:
      labels:
        app: nginx-log-sidecar-demo
    spec:
      containers:
        - name: nginx-log-demo
          image: registry-vpc.${RegionId}.aliyuncs.com/log-service/docker-log-test:latest
          command:
            - /bin/mock_log
          args:
            - '--log-type=nginx'
            - '--stdout=false'
            - '--stderr=true'
            - '--path=/var/log/nginx/access.log'
            - '--total-count=100000000'
            - '--logs-per-sec=100'
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /var/log/nginx
              name: nginx-log           # Text file logs: shared emptyDir volume
        - name: logtail
          image: registry-vpc.${RegionId}.aliyuncs.com/log-service/logtail:latest
          env:
            - name: ALIYUN_LOGTAIL_USER_ID
              value: "${Aliuid}"
            - name: ALIYUN_LOGTAIL_USER_DEFINED_ID
              value: nginx-log-sidecar
            - name: ALIYUN_LOGTAIL_CONFIG
              value: /etc/ilogtail/conf/${RegionId}/ilogtail_config.json
            - name: aliyun_logs_machinegroup
              value: k8s-group-app-alpine
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /var/log/nginx
              name: nginx-log           # Text file logs: same emptyDir volume as the app container
            - mountPath: /stdlog
              name: stdlog             # Standard output logs: ECI stdlog volume
      volumes:
        - emptyDir: {}
          name: nginx-log              # Shared volume for text file logs
        - name: stdlog                 # ECI stdlog volume for standard output logs
          flexVolume:
            driver: alicloud/pod-stdlog

Replace the following placeholders before applying the YAML:

After applying the YAML, verify that all containers are running:

kubectl get pods -l app=nginx-log-sidecar-demo

Expected output — both containers in each pod should show 2/2 Running:

NAME                                      READY   STATUS    RESTARTS   AGE
nginx-log-sidecar-demo-84587d9796-krn5z   2/2     Running   0          32m
nginx-log-sidecar-demo-84587d9796-vhnld   2/2     Running   0          32m

If a pod shows 1/2, one container has not started. Run kubectl describe pod <pod-name> to check the events and identify which container failed.

You can also view the logs using kubectl commands or in the Elastic Container Instance console:

• View logs using kubectl commands

  

• View logs in the Elastic Container Instance console

  

Step 2: Configure Logtail to collect logs

Create a Logtail configuration in the Simple Log Service console to collect the logs from the sidecar.

1. Log on to the Simple Log Service console.

2. On the right side of the console, click the Quick Data Import card. In the Import Data dialog box, click Regular Expression - Text Logs.

3. Select a Project and a Logstore, then click Next. If you do not have a Project or Logstore, click Create Now.

   SLS automatically creates a Project named k8s-log-{K8s-Cluster-ID} for each Kubernetes cluster.

4. Configure the machine group and click Next.

   • Scenario: Select Kubernetes Clusters.

   • Deployment Method: Select Sidecar.

   • Select Machine Group: In the Source Machine Group area, select the target machine group and move it to the Applied Server Groups area. If no machine group is available, click Create Machine Group.

5. Configure Logtail and click Next. Logtail supports collecting text logs in modes including simple single-line, regex, separator, and JSON. For details, see Collect logs from hosts. Use the following settings based on the log type you want to collect: Standard output The log path is the mount path of the stdlog volume in the Logtail sidecar container (/stdlog). To add a processing plug-in, see Process data during collection (processing plug-ins). Text files The log path is the mount path of the shared emptyDir volume in the Logtail sidecar container. To add a processing plug-in, see Process data during collection (processing plug-ins).

   Configuration section	Parameter	Value
   Global Configurations	Configuration Name	stdout
   Input Configurations	Logtail Deployment Mode	Text Log Collection
   	File Path	/stdlog/**/*.log
   Processor Configurations	Processing Method	None

   Configuration section	Parameter	Value
   Global Configurations	Configuration Name	file
   Input Configurations	Logtail Deployment Mode	Text Log Collection
   	File Path	/var/log/nginx/**/*.log
   Processor Configurations	Processing Method	None

6. Configure query and analysis settings. Indexes are configured by default. To reconfigure them, see Configure indexes.

7. Verify that SLS is collecting your logs. After completing the configuration, SLS starts collecting ECI logs. If no logs appear after a few minutes, check that:

   • The Logtail container is running (READY 2/2 in the pod).

   • The file path in the Logtail configuration matches the actual volume mount path in the pod spec.

   • The machine group in the Logtail configuration matches the aliyun_logs_machinegroup value set in the Logtail container's environment variables.