Sending Logs from a Sidecar Container

In certain situations, it may not be feasible to run the ContainIQ agent as a daemonset. For example, with AWS Fargate you cannot schedule daemonsets onto Fargate nodes, or with GKE autopilot you may run into limitations around Fluentd's host map. Fortunately, ContainIQ also supports collecting logs from a sidecar container.



Start by creating a ConfigMap with the necessary Fluentd config.

1. Replace /path-to-log-file with the path where you are logging to
2. Replace ${record["timestamp"]} with correct record from your log message. See https://docs.fluentd.org/filter/record_transformer for more info on how to set up a record transformer.
3. If you would like to add additional fields to ContainIQ for improved searchability you will need to add the additional fields to the record section of the configuration. the following are available
   1. pod_name ex: pod_name ${record["app-field-name-in-log"]}
   2. container
   3. stream

Next add the Fluentd container as a sidecar in your deployment and mount the correct volumes.

1. Replace /path/to/logs with the location of your log file.
2. Add the varlog volume mount to the container you will be logging from.

Finally, add the Fluentd service account under the spec:

Pleas reach out to support@containiq.com with any questions.