stdout / stderr logs from your workloads and — when your applications are instrumented with OpenTelemetry — distributed traces. EKS clusters also emit control plane logs (API server, audit, scheduler, controller manager, authenticator); those are written directly to CloudWatch by AWS and cannot be collected by an in-cluster agent.
Recommended method
ADOT — the OpenTelemetry Collector on EKS collects pod logs and application traces and ships them over OTLP to Bronto. Deploy as a DaemonSet on EC2 node groups; on Fargate-backed EKS, deploy as a per-pod sidecar instead — DaemonSets can’t run on Fargate nodes. Use the sameservice.name / service.namespace routing as your other OTel workloads (see Data Organization).
Alternatives
- Fluent Bit on EKS — DaemonSet that collects container logs from every node; lighter than a full collector.
- Self-Managed OTel Collector — full control over the OpenTelemetry pipeline when ADOT’s distribution doesn’t fit.
- CloudWatch Log Forwarder — required path for EKS control plane logs, which are CloudWatch-only.