English
Exporting Logs from Kubernetes Containers: A Complete Tutorial and Practical Tips for kubectl logs
在 Kubernetes 运维工作中，查看和导出容器日志是排查问题、监控系统状态的重要手段。本文将详细介绍从 Kubernetes 容器中导出日志的各种方法，以及常见问题的解决方案。
Preparatory work
Before you begin, please ensure:
Already installed and configured
kubectlcommand-line toolHas permission to access the target Pod
Know the target Pod's name and namespace.
Method 1: Use kubectl logs Export current logs
kubectl logs is the most basic log viewing command, which can easily export logs to a local file.
Basic usage
bash
# Export the complete Pod logs to a file
kubectl logs my-pod -n default > pod.log
# Specify container (when the Pod has multiple containers)
kubectl logs my-pod -n default -c container-name > pod.logExport the most recent N lines of logs
bash
# Export the last 100 lines of logs.
kubectl logs my-pod -n default --tail=100 > pod.log
# Export the last 1000 lines of logs
kubectl logs my-pod -n default --tail=1000 > pod.logExport logs for a specific time range
bash
# Export the logs from the last 1 hour
kubectl logs my-pod -n default --since=1h > pod.log
# Export logs from the last 24 hours
kubectl logs my-pod -n default --since=24h > pod.log
# Export the logs from the last 30 minutes
kubectl logs my-pod -n default --since=30m > pod.log
# Export logs after a specific point in time
kubectl logs my-pod -n default --since-time="2026-08-06T08:00:00Z" > pod.logExport logs containing timestamps
bash
# Add a timestamp to each log line
kubectl logs my-pod -n default --timestamps > pod.logMethod 2: Track and save logs in real time
Use -f Parameters can track log output in real time while saving it to a file.
View and save in real time
bash
# Track logs in real time and save them to a file (press Ctrl+C to stop)
kubectl logs -f my-pod -n default | tee pod.log
# Specified container
kubectl logs -f my-pod -n default -c container-name | tee pod.logTrack from the beginning
bash
# Show all historical logs from the beginning, then follow new logs
kubectl logs -f my-pod -n default --tail=-1 | tee pod.logMethod 3: Export logs of all containers in a multi-container Pod
When there are multiple containers in a Pod, the logs of each container need to be exported separately.
Manually export one by one
bash
# View all containers in the Pod
kubectl get pod my-pod -n default -o jsonpath='{.spec.containers[*].name}' && echo ""
# Export the logs of each container separately.
kubectl logs my-pod -n default -c container1 > container1.log
kubectl logs my-pod -n default -c container2 > container2.log
kubectl logs my-pod -n default -c container3 > container3.logUse a loop for batch export.
bash
# Get all container names and export them one by one.
for container in $(kubectl get pod my-pod -n default -o jsonpath='{.spec.containers[*].name}'); do
kubectl logs my-pod -n default -c $container > ${container}.log
echo "Exported $container logs to ${container}.log"
doneUse --all-containers Parameter
bash
# Export the logs of all containers (output will be mixed)
kubectl logs my-pod -n default --all-containers > all-containers.logMethod 4: Export logs for all containers in the Pod (including terminated ones)
After the container restarts,kubectl logs By default, only the logs of the current container are displayed. Use --previous You can view the logs of terminated containers.
View and export the logs of terminated containers
bash
# Export the logs of the previous container
kubectl logs my-pod -n default --previous > pod-previous.log
# Export current + previous container logs (merged)
kubectl logs my-pod -n default > pod-current.log
kubectl logs my-pod -n default --previous > pod-previous.log
cat pod-current.log pod-previous.log > pod-all.logExport the historical logs of all containers.
bash
# Use a loop to export the current and historical logs of all containers
for container in $(kubectl get pod my-pod -n default -o jsonpath='{.spec.containers[*].name}'); do
# Current log
kubectl logs my-pod -n default -c $container > ${container}-current.log
# Historical logs (if any)
kubectl logs my-pod -n default -c $container --previous > ${container}-previous.log 2>/dev/null
# Merge
cat ${container}-current.log ${container}-previous.log > ${container}-all.log
echo "Exported all logs for $container"
doneMethod 5: Obtain the raw log files on the node
when kubectl logs If unavailable (e.g., the Pod has been deleted, the API Server is unavailable, etc.), you can log in directly to the node to view the log file.
View the log path on the node
bash
# Log in to the node
ssh node-01
# Kubernetes default log path (depending on the container runtime)
# Docker/CRI-O default path
ls -la /var/log/pods/
# Find logs for a specific Pod
find /var/log/pods -name "*.log" | grep my-podView the log file for a specific Pod
bash
# Enter the Pod's log directory
cd /var/log/pods/default_my-pod_<uid>/
# View container logs
ls -la
cat *.logUse crictl View container logs
bash
# List containers
crictl ps -a | grep my-pod
# View container logs
crictl logs <container-id>Method 6: Using a Log Aggregation System
In production environments, log aggregation systems (such as EFK, Loki, Splunk, etc.) are usually used to centrally manage logs, enabling queries against more complete historical logs.
Common log aggregation solutions
| Plan | Component | Characteristics |
|---|---|---|
| EFK | Elasticsearch + Fluentd + Kibana | Powerful features, flexible queries, suitable for large-scale use |
| ELK | Elasticsearch + Logstash + Kibana | Mature ecosystem and rich plugins |
| Loki | Loki + Promtail + Grafana | Lightweight, integrated with the Prometheus ecosystem |
| Splunk | Splunk Enterprise | Business solutions, enterprise-grade features |
Use the log system to query logs.
bash
# Example: Query using Loki CLI
logcli query '{namespace="default", pod="my-pod"}' --limit=1000
# Example: Use the kubectl plugin (if configured)
kubectl logs --tail=1000 -l app=my-app > app-all-pods.logVerify log export integrity
After exporting the logs, it is recommended to verify the integrity of the logs:
bash
# View file size
ls -la pod.log
# View log line count
wc -l pod.log
# View the log time range (if it contains timestamps)
head -5 pod.log
tail -5 pod.log
# Check for truncation
grep -i "truncated\|cut off\|... truncated" pod.logCommon Issues and Solutions
Issue 1: The Pod has been deleted, so the logs cannot be viewed.
Error message:
Error from server (NotFound): pods "my-pod" not foundSolution:
Option 1: View the original log files on the node
bash
# Log in to the node where the Pod is located.
ssh node-01
# Find logs of deleted Pods (if log rotation hasn't cleaned them up yet)
find /var/log/pods -name "*.log" | grep my-podOption 2: Configure log persistence
bash
# Recommendation: Deploy a log collection system (such as Fluentd) in the cluster.
# Persist logs to Elasticsearch or object storageOption 3: Add a log retention policy for Pods
yaml
# Configure log rotation and retention in Pods
# Example: Use logrotate or the container runtime's logging configuration.Problem 2: The log file is too large, and the export times out.
Error message:
timed out waiting for the conditionSolution:
bash
# Option 1: Use --tail to limit the number of lines
kubectl logs my-pod -n default --tail=10000 > pod.log
# Option 2: Use --since to limit the time range
kubectl logs my-pod -n default --since=1h > pod.log
# Option 3: Chunked export
kubectl logs my-pod -n default --tail=50000 > pod-part1.log
kubectl logs my-pod -n default --tail=100000 > pod-part2.log
# Option 4: Compress in the container before exporting.
kubectl exec my-pod -n default -- sh -c "cat /var/log/app.log | gzip" > pod.log.gzProblem 3: Multi-container Pod log confusion
Problem description: Use --all-containers When multiple containers' logs are mixed together, it is difficult to distinguish them.
Solution:
bash
# Option 1: Export separately to different files
for container in $(kubectl get pod my-pod -n default -o jsonpath='{.spec.containers[*].name}'); do
kubectl logs my-pod -n default -c $container > ${container}.log
done
# Option 2: Add a container name prefix on export
kubectl logs my-pod -n default --all-containers --timestamps | \
awk '{print "[\033[32m" container "\033[0m] " $0}' container="my-container"Problem 4: Logs are truncated by rotation
Problem description: Container logs are configured with rotation (logrotate),kubectl logs You can only see the contents of the current log file.
Solution:
bash
# Option 1: View the rotated log files on the node
ssh node-01
ls -la /var/log/pods/default_my-pod_<uid>/*.log*
# Option 2: Configure a longer log retention period
# Adjust the max-size and max-file parameters in the container runtime configurationProblem 5: The logs contain non-UTF-8 characters
Problem description: The logs contain binary or non-UTF-8 characters, which appear garbled after export.
Solution:
bash
# Use the strings command to extract readable text.
kubectl logs my-pod -n default | strings > pod.log
# Or use iconv to convert the encoding
kubectl logs my-pod -n default | iconv -f UTF-8 -t UTF-8//IGNORE > pod.logPractical operation example
The following is a complete operation example showing how to export logs from the CSI node plugin container.
Scene Background
Need to from csi-nodeplugin Pod's cluster Export the last 1000 lines of logs from the container and save them to a local file.
Operating Steps
Step 1: View the containers in the Pod
bash
kubectl get pod csi-nodeplugin-dv5l2 -n finalfs \
-o jsonpath='{.spec.containers[*].name}' && echo ""Output:
liveness-probe driver-registrar clusterStep 2: Export logs
bash
# Export the last 1000 lines of logs from the cluster container.
kubectl logs csi-nodeplugin-dv5l2 -n finalfs \
-c cluster --tail=1000 > cluster.logStep 3: Add timestamps (to facilitate analysis)
bash
kubectl logs csi-nodeplugin-dv5l2 -n finalfs \
-c cluster --tail=1000 --timestamps > cluster-with-timestamp.logStep 4: View the exported log information
bash
# View log line count
wc -l cluster.log
# View log time range
head -1 cluster-with-timestamp.log
tail -1 cluster-with-timestamp.logComparison of log export methods
| Method | Applicable scenarios | Advantages | shortcoming |
|---|---|---|---|
kubectl logs > file | General log export | Simple and direct, supports filtering. | The Pod cannot be used after deletion. |
| `kubectl logs -f | tee` | Monitor in real time and save | Can view and save at the same time |
--tail/--since | Export partial logs | Avoid large files and be efficient. | Historical logs may be lost |
--previous | View the logs of the restarted container | Can view historical logs | Can only view the previous one |
| Node raw logs | Pod deletion scenario | Does not depend on the API Server | Node access permission required |
| Log Aggregation System | Production environment long-term storage | Complete history, flexible queries | Requires additional deployment and maintenance. |
Best Practices Summary
Prefer to use
kubectl logs+ Redirect: The simplest and most direct wayUse
--tailLimit log volume: Avoid performance issues caused by exporting large filesuse
--timestampsAdd timestamp: To facilitate subsequent analysis and troubleshooting.Export multi-container Pods separately: Avoid log confusion and facilitate analysis
View node logs when a Pod has been deleted: Log in to the node to obtain the original log file
Deploy a log aggregation system in the production environment Ensure long-term log retention and queryability
Configure a reasonable log rotation strategy.: Prevent logs from filling up disk space
Verify integrity after export Confirm that the number of log lines and the time range meet expectations.