Logging & log aggregation

The logs can be forwarded to a Vector log aggregator by providing a discovery ConfigMap for the aggregator and by enabling the log agent:

spec:
  clusterConfig:
    vectorAggregatorConfigMapName: vector-aggregator-discovery
  nameNodes:
    config:
      logging:
        enableVectorAgent: true
  dataNodes:
    config:
      logging:
        enableVectorAgent: true
  journalNodes:
    config:
      logging:
        enableVectorAgent: true

The logs of the containerdebug process are collected as well. They are labelled container: containerdebug, although no such Kubernetes container exists. The process runs in the background of the namenode, datanode and journalnode containers. The label comes from /stackable/log/containerdebug, the directory which the operator sets with the FILE_LOG_DIRECTORY environment variable and from which the Vector agent derives the container name. Overriding FILE_LOG_DIRECTORY with envOverrides therefore changes how these logs are aggregated. The agent only collects files one level below /stackable/log, so a sibling directory such as /stackable/log/namenode relabels the events instead of dropping them, while any deeper or shallower path stops the aggregation. A path outside /stackable/log also leaves the size-capped log volume.

Further information on how to configure logging, can be found in Logging.