A way to ingest audit logs from kubernetes apiserver

[jorotg]

Hi guys,

We use fluentd-elasticsearch helm chart in our environment. I tried to add filter to collect audit logs from kube apiserver but for some reason I can't see them in Kibana. My configuration in templates/configmaps.yaml is:

<source>
      @id kube-apiserver-audit.log
      @type tail
      format json
      path /var/log/apiserver/audit.log
      pos_file /var/log/apiserver/audit.log.pos
      time_key timestamp
      time_format %Y-%m-%dT%H:%M:%SZ
      tag kube-apiserver-audit
 </source>

which doesn't seem to work.

[NelsonJeppesen]

@jorotg Maybe not what you're looking for but what I did was output audit logs to stdout from apiserver. Then fluentd pulls it in just like any other pod logs

As configured with kops

  kubeAPIServer:
    # Log audit log to stdout for fluentd
    auditLogPath: "-"

[jorotg]

Thank you Nelson! Most likely I'm going to use your approach too.