Log aggregation

The logs can be forwarded to a Vector log aggregator by providing a discovery ConfigMap for the aggregator and by enabling the log agent:

spec:
  clusterConfig:
    vectorAggregatorConfigMapName: vector-aggregator-discovery
  servers:
    config:
      logging:
        enableVectorAgent: true
        containers:
          prepare:
            console:
              level: INFO
            file:
              level: INFO
            loggers:
              ROOT:
                level: INFO
    roleGroups:
      default:
        replicas: 1

The logs of the containerdebug process are collected as well. They are labelled container: containerdebug, although no such Kubernetes container exists. The process runs in the background of the zookeeper container. The label comes from /stackable/log/containerdebug, the directory which the operator sets with the FILE_LOG_DIRECTORY environment variable and from which the Vector agent derives the container name. Overriding FILE_LOG_DIRECTORY with envOverrides therefore changes how these logs are aggregated. The agent only collects files one level below /stackable/log, so a sibling directory such as /stackable/log/zookeeper relabels the events instead of dropping them, while any deeper or shallower path stops the aggregation. A path outside /stackable/log also leaves the size-capped log volume.

Further information on how to configure logging, can be found in Logging.