> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes pod logs with OpenTelemetry

> Deploy the OpenTelemetry Collector as a DaemonSet to collect Kubernetes pod logs, node events, and container metadata and forward everything to Bronto.

Collect container (pod) logs across a Kubernetes cluster by running the OpenTelemetry Collector as a DaemonSet. The same Collector can also receive traces and metrics from your applications — see [Connect OpenTelemetry Collector to Bronto](/agent-setup/open-telemetry).

## Prerequisites

* A Bronto account and API key ([how to create one](/Account-Management/API-Keys#create-a-new-api-key))
* A Kubernetes cluster with `kubectl` and Helm access
* Pods writing to stdout/stderr (collected from `/var/log/pods` on each node)

## Deploy the Collector DaemonSet

Install the Collector with the [OpenTelemetry Helm chart](https://github.com/open-telemetry/opentelemetry-helm-charts/tree/main/charts/opentelemetry-collector). Its `logsCollection` preset wires up the `filelog` receiver and node log mounts; the `kubernetesAttributes` preset adds pod, namespace, and node metadata and the RBAC it needs:

```yaml values.yaml theme={"dark"}
mode: daemonset

presets:
  logsCollection:
    enabled: true
  kubernetesAttributes:
    enabled: true

config:
  exporters:
    otlphttp/brontologs:
      logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
      compression: gzip
      headers:
        x-bronto-api-key: <YOUR_API_KEY>
        x-bronto-collection: <CLUSTER_NAME>
  service:
    pipelines:
      logs:
        exporters: [otlphttp/brontologs]
```

```bash theme={"dark"}
helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
helm install otel-collector open-telemetry/opentelemetry-collector -f values.yaml
```

Set `<REGION>` to `eu` or `us`. Use `x-bronto-collection` to identify the cluster; Bronto infers per-workload datasets from the Kubernetes metadata.

## Cluster events

The DaemonSet above collects pod logs only. To also capture Kubernetes events (scheduling, image pulls, OOMKills, evictions), run a **second** Collector as a single-replica Deployment with the `kubernetesEvents` preset — it adds the `k8sobjects` receiver and the RBAC to watch events. Use a Deployment, not the DaemonSet, so events are not duplicated across nodes:

```yaml events-values.yaml theme={"dark"}
mode: deployment
replicaCount: 1

presets:
  kubernetesEvents:
    enabled: true

config:
  exporters:
    otlphttp/brontologs:
      logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
      compression: gzip
      headers:
        x-bronto-api-key: <YOUR_API_KEY>
        x-bronto-collection: <CLUSTER_NAME>
  service:
    pipelines:
      logs:
        exporters: [otlphttp/brontologs]
```

```bash theme={"dark"}
helm install otel-events open-telemetry/opentelemetry-collector -f events-values.yaml
```

This needs a Collector image that bundles the `k8sobjects` receiver (the `k8s` or contrib distribution). Events arrive in Bronto as log records carrying the event reason, message, involved object, and namespace.

## What you will see in Bronto

Open [Search](https://app.bronto.io/search) and filter by your collection. Each record carries the container's stdout/stderr line plus Kubernetes attributes — pod name, namespace, node, container name, and labels. Bronto's [Custom Parser](/core-features/custom-parser) extracts structured fields from the log body server-side.

## Troubleshooting

* **No logs?** Confirm the DaemonSet is running on every node (`kubectl get pods -l app.kubernetes.io/name=opentelemetry-collector`) and that nodes expose logs under `/var/log/pods`.
* **Missing pod metadata?** The `kubernetesAttributes` preset creates the required RBAC by default — confirm it is enabled.
* For general issues, see [OTel Collector troubleshooting](https://opentelemetry.io/docs/collector/troubleshooting/).

## Alternative: Fluent Bit

Fluent Bit is a long-established way to collect Kubernetes pod logs and a fine choice if your organization already runs it. Deploy it as a DaemonSet via the [official Helm chart](https://github.com/fluent/helm-charts):

```ini fluent-bit.conf theme={"dark"}
[INPUT]
    name              tail
    path              /var/log/containers/*.log
    multiline.parser  docker, cri
    tag               kube.*

[FILTER]
    name                kubernetes
    match               kube.*
    k8s-logging.parser  on
    k8s-logging.exclude on

[OUTPUT]
    name                http
    match               kube.*
    host                ingestion.<REGION>.bronto.io
    port                443
    tls                 on
    format              json_lines
    compress            gzip
    header              x-bronto-api-key    <YOUR_API_KEY>
    header              x-bronto-collection <CLUSTER_NAME>
```

Set **Format** to `json_lines`, not `json`. The `kubernetes` filter enriches each log with pod metadata, mirroring the `kubernetesAttributes` preset. Fluent Bit does not collect cluster events — use the OpenTelemetry Collector for those. See [Connect Fluent Bit to Bronto](/agent-setup/fluent-bit) for details.