Collect log data from containers by using Log Service - User Guide for Kubernetes Clusters| Alibaba Cloud Documentation Center

Container Service for Kubernetes (ACK) is integrated with Log Service. When you create an ACK cluster, you can enable Log Service to collect log data from containers, including standard output (stdout) and text files.

Step 1: Install Logtail

When you create a cluster, select Enable Log service to install Logtail. You can also install Logtail for an existing cluster.

Install Logtail when you create a cluster:

Log on to the ACK console.
In the left-side navigation pane of the ACK console, click Clusters.
In the upper-right corner of the Clusters page, click Create Kubernetes Cluster.
In this example, only the steps to enable Log Service are described. For more information about how to create an ACK cluster, see Create an ACK managed cluster.
On the Component Configurations wizard page, select Enable Log Service to install Logtail in the cluster to be created.
If you select the Enable Log Service check box, the system prompts you to create a Log Service project. For more information about Log Service projects, see Project. You can use one of the following methods to create a Log Service project:
- Click Select Project and select an existing project to manage the collected log.
- Click Create Project. Then, a project named k8s-log-{ClusterID} is automatically created to manage the collected log. ClusterID indicates the unique ID of the cluster to be created.
After you set the parameters, click Create Cluster in the lower-right corner. In the message that appears, click OK.
After the ACK cluster is created, you can find the cluster that has Logtail enabled on the Clusters page.

Install Logtail for an existing cluster

Log on to the ACK console.
In the left-side navigation pane of the ACK console, click Clusters.
On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.
In the left-side navigation pane of the details page, choose Operations > Add-ons. In the Logs and Monitoring section, find logtail-ds.
Click Install next to logtail-ds.
In the Install message, click OK.

If an earlier version of Logtail is installed, click Upgrade next to logtail-ds.

Step 2: Configure Log Service when you create an application

You can configure Log Service to collect log data from containers when you create an application. You can use the wizard in the console or YAML templates to create applications.

Use the wizard in the console to create an application and configure Log Service

Log on to the ACK console.
In the left-side navigation pane of the ACK console, click Clusters.
On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.
In the left-side navigation pane of the details page, choose Workloads > Deployments.
On the Deployments page, select a namespace from the Namespace drop-down list. Then, click Create from Image in the upper-right corner of the page.
On the Basic Information wizard page, specify Name, Replicas, and Type. Then, click Next to go to the Container wizard page.
The following steps describe how to configure Log Service. For more information about other configuration items, see Create a stateless application by using a Deployment.
In the Log section, Click the plus sign (+) to add a configuration entry. Each configuration entry consists of Logstore and Log Path in Container (can be set to stdout).
- Logstore: specifies the Logstore that stores the collected log data. If the specified Logstore does not exist, the system automatically creates a Logstore in the Log Service project that is associated with the cluster.
  
  Note The name of the Logstore cannot contain underscores (_). You can use hyphens (-) instead.
- Log Path in Container (Can be set to stdout): specifies the path from which you want to collect log data. A value of /usr/local/tomcat/logs/catalina.*.log indicates that the log files of a Tomcat application are collected.
  
  Note If you set the value to stdout, stdout and stderr are collected.
  
  After you add a configuration entry, the system automatically creates a Logstore. By default, Logtail collects log data in simple mode. In this mode, log data is collected by line. To use more log collection methods, log on to the Log Service console and modify the log collection configurations of the project and Logstore. By default, the project uses k8s-log as the prefix.
Set Custom Tag.
Click the plus sign (+) to add custom tags. Each tag is a key-value pair that is appended to the collected log data. You can use custom tags to mark log data. For example, you can use a tag to denote the application version.
After you set other parameters, click Next to set advanced settings. For more information, see Create a stateless application by using a Deployment.

Create an application by using a YAML template

In the left-side navigation pane of the cluster details page, click Workloads.
On the Deployments page, select a namespace from the Namespace drop-down list. Then, click Create from YAML in the upper-right corner of the page.
YAML templates comply with the Kubernetes syntax. You can use env to define log collection configurations and custom tags. You must also set the volumeMounts and volumes parameters. The following code is an example:
```
apiVersion: v1
kind: Pod
metadata:
  name: my-demo
spec:
  containers:
  - name: my-demo-app
    image: 'registry.cn-hangzhou.aliyuncs.com/log-service/docker-log-test:latest'
    env:
    ######### Specify environment variables ###########
    - name: aliyun_logs_log-stdout
      value: stdout
    - name: aliyun_logs_log-varlog
      value: /var/log/*.log
    - name: aliyun_logs_mytag1_tags
      value: tag1=v1
    ###############################
    ######### Specify volume mounting. ###########
    volumeMounts:
    - name: volumn-sls-mydemo
      mountPath: /var/log
  volumes:
  - name: volumn-sls-mydemo
    emptyDir: {}
  ###############################
```
Perform the following steps in sequence based on your requirements:

Note If you have more requirements for log collection, see Step 3: Configure advanced settings in the env field.
1. Add log collection configurations and custom tags by using environment variables. All environment variables related to log collection must use aliyun_logs_ as the prefix.
  - Add log collection configurations in the following format:
```
- name: aliyun_logs_log-stdout
  value: stdout
- name: aliyun_logs_log-varlog
  value: /var/log/*.log                        
```
    In the preceding example, two environment variables in the following format are added to the log collection configuration: aliyun_logs_{key}. The {keys} of the environment variables are log-stdout and log-varlog.
    - Environment variable aliyun_logs_log-stdout indicates that a Logstore named log-stdout is created to store the stdout files collected from containers. The name of the collection configuration is log-stdout. This way, the stdout files of containers are collected to the Logstore named log-stdout.
    - Environment variable aliyun_logs_log-varlog indicates that a Logstore named log-varlog is created to store the collected log files to the /var/log/*.log path. The name of the collection configuration is log-varlog. This way, text files of the /var/log/*.log file are collected to the Logstore named log-varlog.
  - Add custom tags in the following format:
```
- name: aliyun_logs_mytag1_tags
  value: tag1=v1                       
```
    After a tag is added, the tag is automatically appended to the log data that is collected from the container. mytag1 specifies the tag name without underscores (_).
2. If you specify a log path to collect log files other than stdout, you must set the volumeMounts parameter.
  In the preceding YAML template, the mountPath field in volumeMounts is set to /var/log. This allows Logtail to collect log data from the /var/log/*.log file.
After you edit the YAML template, click Create to submit the configurations.

Step 3: Configure advanced settings in the env field

You can specify various environment variables to configure log collection. The following table describes the variables.

Notice This configuration method is not applicable to edge computing scenarios.


Variable	Description	Example	Considerations
aliyun_logs_{key}	Required. {key} can contain only lowercase letters, digits, and hyphens (-). If the specified aliyun_logs_{key}_logstore does not exist, a Logstore named {key} is created. To collect the stdout of the container, set the value to stdout. You can also set the value to a path inside the container to collect the log files.	`- name: aliyun_logs_catalina stdout` `- name: aliyun_logs_access-log /var/log/nginx/access.log`	By default, Logtail collects log data in simple mode. In this case, the collected log data is not parsed. If you want to parse the log data, we recommend that you change the collection mode in the Log Service console. For more information, see Use the console to collect Kubernetes text files in DaemonSet mode, Use the console to collect Kubernetes stdout and stderr in DaemonSet mode, or Use CRDs to collect container logs in DaemonSet mode. The value of {key} must be unique in the cluster.
aliyun_logs_{key}_tags	Optional. This parameter is used to add tags to log data. The value must be in the following format: {tag-key}={tag-value}.	`- name: aliyun_logs_catalina_tags app=catalina`	-
aliyun_logs_{key}_project	Optional. This variable specifies a project in Log Service. By default, the project that you specified when you created the cluster is used.	`- name: aliyun_logs_catalina_project my-k8s-project`	The project must be deployed in the same region as Logtail.
aliyun_logs_{key}_logstore	Optional. This variable specifies a Logstore in Log Service. By default, the Logstore is named {key}.	`- name: aliyun_logs_catalina_logstore my-logstore`	-
aliyun_logs_{key}_shard	Optional. This variable specifies the number of shards in the Logstore. Valid values: 1 to 10. Default value: 2.	`- name: aliyun_logs_catalina_shard 4`	-
aliyun_logs_{key}_ttl	Optional. This variable specifies the number of days for which log data is retained. Valid values: 1 to 3650. To retain log data permanently, set the value to 3650. Default value: 90.	`- name: aliyun_logs_catalina_ttl 3650`	-
aliyun_logs_{key}_machinegroup	Optional. This variable specifies the node group in which the application is deployed. The default node group is the one in which Logtail is deployed.	`- name: aliyun_logs_catalina_machinegroup my-machine-group`	-

Scenario 1: Collect log data from multiple applications and store them in the same Logstore
In this scenario, set the aliyun_logs_{key}_logstore variable. The following example shows how to collect stdout from two applications and store the output in stdout-logstore.

The {key} of Application 1 is set to app1-stdout. The {key} of Application 2 is set to app2-stdout.
Configure the following environment variables for Application 1:
```
######### Specify environment variables ###########
    - name: aliyun_logs_app1-stdout
      value: stdout
    - name: aliyun_logs_app1-stdout_logstore
      value: stdout-logstore
```
Configure the following environment variables for Application 2:
```
######### Specify environment variables ###########
    - name: aliyun_logs_app2-stdout
      value: stdout
    - name: aliyun_logs_app2-stdout_logstore
      value: stdout-logstore
```
Scenario 2: Collect log data from different applications and store them in different projects
In this scenario, perform the following steps:
1. Create a machine group in each project and set the machine group ID in the following format: k8s-group-{cluster-id}, where {cluster-id} is the ID of the cluster. You can customize the machine group name.
2. Specify the project, Logstore, and the machine group in the environment variables for each application. The name of the machine group is the same as that of the machine group that you created in the previous step.
  In the following example, the {key} of Application 1 is set to app1-stdout. The {key} of Application 2 is set to app2-stdout. If the two applications are deployed in the same ACK cluster, you can use the same machine group for the applications.
  Configure the following environment variables for Application 1:
```
######### Specify environment variables ###########
    - name: aliyun_logs_app1-stdout
      value: stdout
    - name: aliyun_logs_app1-stdout_project
      value: app1-project
    - name: aliyun_logs_app1-stdout_logstore
      value: app1-logstore
    - name: aliyun_logs_app1-stdout_machinegroup
      value: app1-machine-group
```
  Configure the following environment variables for Application 2:
```
######### Specify environment variables for Application 2###########
    - name: aliyun_logs_app2-stdout
      value: stdout
    - name: aliyun_logs_app2-stdout_project
      value: app2-project
    - name: aliyun_logs_app2-stdout_logstore
      value: app2-logstore
    - name: aliyun_logs_app2-stdout_machinegroup
      value: app1-machine-group
```

Step 4: View log data

The following example shows how to view the log data of a Tomcat application created by using the wizard in the console. The Log data of the Tomcat application is stored in Log Service. You can log on to the Log Service console to view log data collected from the containers. To view the log data, perform the following steps:

Log on to the Log Service console.
In the Projects section, click the project that is associated with the Kubernetes cluster to go to the Logstores tab. By default, the project name is in the format of k8s-log-{Kubernetes cluster ID}.
In the Logstore list, find the Logstore that is specified when you configure log collection. Move the pointer over the Logstore name and click the icon. Then, click Search & Analysis.
In this example, you can view the stdout of the Tomcat application and text log files of containers. You can also find that custom tags are appended to the collected log data.

After Log Service is enabled for the application, you can view the logs of containers in the ACK console. Perform the following steps:

Log on to the ACK console.
In the left-side navigation pane of the ACK console, click Clusters.
On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.
In the left-side navigation pane of the details page, choose Operations > Log Center.
On the Log Center page, click the Application Logs tab and specify the filter conditions. Then, click Select Logstore to view the logs of containers.

What to do next

By default, Log Service collects log data by line and does not parse the log data. If you want to change the log collection mode and parse the log data, modify the log collection configurations in the Log Service console. For more information, see the following topics:
- Use the console to collect Kubernetes text log files in DaemonSet mode
- Use the console to collect Kubernetes stdout and stderr in DaemonSet mode
You can also use CustomResourceDefinition (CRD) objects to collect log data from Kubernetes clusters..
For more information about troubleshooting, see What do I do if errors occur when I use Logtail to collect logs?.