Edge Delta Kubernetes Event Input

Overview

You can use the Kubernetes Event Input node to ingest Kubernetes events from the cluster when there is a state change in a cluster resource. If there is more than one agent in the cluster, a leader election process selects an agent to collect all the events. Events have the item.type=event attribute. If you connect the Kubernetes Event Input node to the ed_archive_output node, the events are searchable using the Search tab on the Logs page with the search string: @item.type:event.

• outgoing_data_types: log

Example Configuration

nodes:
  - name: my_k8s_event_input
    type: k8s_event_input
    report_interval: 1m

Example Input

Consider the following event:

local-path-storage 30m Warning BackOff pod/local-path-provisioner-6bc4bddd6b-l8245 Back-off restarting failed container local-path-provisioner in pod local-path-provisioner-6bc4bddd6b-l8245_local-path-storage(a22f97a0-96d2-4883-8aa7-7850f20f094d)

After ingestion using the k8s_event_input node connected to ed_archive, the event is available in Log Search:

Required Parameters

name

A descriptive name for the node. This is the name that will appear in Visual Pipelines and you can reference this node in the yaml using the name. It must be unique across all nodes. It is a yaml list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: k8s_event_input

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

report_interval

The report_interval parameter defines the interval at which to report events. It is specified as a duration and the default value is 1m. The report_interval parameter is optional.

nodes:
  - name: ed_k8s_events
    type: k8s_event_input
    report_interval: 1m