Get logs from Kubectl POD specifying Level (only ERROR)

Question

I would like to know if is possible to filter logs, only showing ERROR Level

kubectl logs -f -n the-namespace the-pod [LOG-LEVEL?] in example ERROR only

I was trying with:

kubectl logs -f -n bci-api the-pod | awk '{ if ($3 == "ERROR") { print } }' 

The problem, are there some lines that are continuation of ERROR line and will be hidden!

Is it possible?

Thanks in advance!

Answer 1

According to this documentation there doesn't seem to be a way you can do this. There is a verbosity flag -v but that is for the level of verbosity in kubectl itself, not in the logs it is getting for the pods/containers.

Then you also have the --stderrthreshold <SEVERITY> option to kubectl as provided in this doc, but I suspect that is the same thing.

Perhaps a better way of handling this would be to set what is called a logging architecture for your cluster where you can control which logs the pod actually generates. (read more here) In that way, fetching them from kubectl will be probably more desirable.

We almost always use a 3rd party centralized logging solution (like fleuntd), outside of k8s for this specific reason. And we simply inject a logging sidecar container to your pods which continuously dumps the logs to this central component. This is a very common design pattern.

Answer 2

can use grep functionality to filter errors from the entire logs

kubectl logs -f -n bci-api the-pod | grep -i 'Error'

Answer 3

in addition to the above answer of @Be_hegade answer, if your error spreads along multiple lines, or you want to see extra content, you can use the following grep command flags:

  -B, --before-context=NUM  print NUM lines of leading context
  -A, --after-context=NUM   print NUM lines of trailing context
  -C, --context=NUM         print NUM lines of output context
  -NUM                      same as --context=NUM

Answer 4

grep wont work if message with level INFO/WARNING will contains word error

kubectl logs -f -n bci-api the-pod | awk '{ if ($3 ~ "ERROR") { print } }'