Skip to main content
Collect container (pod) logs across a Kubernetes cluster by running the OpenTelemetry Collector as a DaemonSet. The same Collector can also receive traces and metrics from your applications — see Connect OpenTelemetry Collector to Bronto.

​
Prerequisites

  • A Bronto account and API key (how to create one)
  • A Kubernetes cluster with kubectl and Helm access
  • Pods writing to stdout/stderr (collected from /var/log/pods on each node)

​
Deploy the Collector DaemonSet

Install the Collector with the OpenTelemetry Helm chart. Its logsCollection preset wires up the filelog receiver and node log mounts; the kubernetesAttributes preset adds pod, namespace, and node metadata and the RBAC it needs:
values.yaml
mode: daemonset

presets:
  logsCollection:
    enabled: true
  kubernetesAttributes:
    enabled: true

config:
  exporters:
    otlphttp/brontologs:
      logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
      compression: gzip
      headers:
        x-bronto-api-key: <YOUR_API_KEY>
        x-bronto-collection: <CLUSTER_NAME>
  service:
    pipelines:
      logs:
        exporters: [otlphttp/brontologs]

helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
helm install otel-collector open-telemetry/opentelemetry-collector -f values.yaml
Set <REGION> to eu or us. Use x-bronto-collection to identify the cluster; Bronto infers per-workload datasets from the Kubernetes metadata.

​
Cluster events

The DaemonSet above collects pod logs only. To also capture Kubernetes events (scheduling, image pulls, OOMKills, evictions), run a second Collector as a single-replica Deployment with the kubernetesEvents preset — it adds the k8sobjects receiver and the RBAC to watch events. Use a Deployment, not the DaemonSet, so events are not duplicated across nodes:
events-values.yaml
mode: deployment
replicaCount: 1

presets:
  kubernetesEvents:
    enabled: true

config:
  exporters:
    otlphttp/brontologs:
      logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
      compression: gzip
      headers:
        x-bronto-api-key: <YOUR_API_KEY>
        x-bronto-collection: <CLUSTER_NAME>
  service:
    pipelines:
      logs:
        exporters: [otlphttp/brontologs]

helm install otel-events open-telemetry/opentelemetry-collector -f events-values.yaml
This needs a Collector image that bundles the k8sobjects receiver (the k8s or contrib distribution). Events arrive in Bronto as log records carrying the event reason, message, involved object, and namespace.

​
What you will see in Bronto

Open Search and filter by your collection. Each record carries the container’s stdout/stderr line plus Kubernetes attributes — pod name, namespace, node, container name, and labels. Bronto’s Custom Parser extracts structured fields from the log body server-side.

​
Troubleshooting

  • No logs? Confirm the DaemonSet is running on every node (kubectl get pods -l app.kubernetes.io/name=opentelemetry-collector) and that nodes expose logs under /var/log/pods.
  • Missing pod metadata? The kubernetesAttributes preset creates the required RBAC by default — confirm it is enabled.
  • For general issues, see OTel Collector troubleshooting.

​
Alternative: Fluent Bit

Fluent Bit is a long-established way to collect Kubernetes pod logs and a fine choice if your organization already runs it. Deploy it as a DaemonSet via the official Helm chart:
fluent-bit.conf
[INPUT]
    name              tail
    path              /var/log/containers/*.log
    multiline.parser  docker, cri
    tag               kube.*

[FILTER]
    name                kubernetes
    match               kube.*
    k8s-logging.parser  on
    k8s-logging.exclude on

[OUTPUT]
    name                http
    match               kube.*
    host                ingestion.<REGION>.bronto.io
    port                443
    tls                 on
    format              json_lines
    compress            gzip
    header              x-bronto-api-key    <YOUR_API_KEY>
    header              x-bronto-collection <CLUSTER_NAME>
Set Format to json_lines, not json. The kubernetes filter enriches each log with pod metadata, mirroring the kubernetesAttributes preset. Fluent Bit does not collect cluster events — use the OpenTelemetry Collector for those. See Connect Fluent Bit to Bronto for details.