Managed Kafka Cloudwatch Queries examples

mk-cloudwatch-examples.adoc

Example queries

Strimi Operator logs

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.namespace_name = "redhat-managed-kafka-operator"
| filter kubernetes.pod_name like /strimzi-cluster-operator/

KAS Fleetshard Operator Logs

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.namespace_name = "redhat-kas-fleetshard-operator"
| filter kubernetes.pod_name like /kas-fleetshard-operator/

KAS Fleetshard Sync Logs

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.namespace_name = "redhat-kas-fleetshard-operator"
| filter kubernetes.pod_name like /kas-fleetshard-sync/

Kafka Container Logs

Brokers

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.container_name = "kafka"

Zookeepers

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.container_name = "zookeeper"

Other valid container_names:

• admin-server

• canary

• <kafkaname>-kafka-exporter (use filter kubernetes.container_name like /-kafka-exporter/)

You can also filter by the pod instead if you want to get all container logs for a pod. For example to get all kafak broker pod logs:

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.pod_name like /kafka-\d/

To filter to a specific Kafka, you need to either know the kafka namespace or the Kafka CR name. The name of the Kafka CR is prefixed on all pod names. For example, if the Kafka CR has a name 'my-first-kafka-instance', you can get the broker pod logs using this query:

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.pod_name like /my-first-kafka-instance-kafka-\d/

The Kafka namespace is typically prefixed with a sanitised version of the user id. For a user id of davmarti_kafka_sre, the namespace would be something like davmarti-kafka-sre-1pcsdw1qezcmvwfrcdfwbkivxc6. For example, to filter broker pod logs for this user, you can use the following:

fields @timestamp, @log, message
| sort @timestamp desc
| limit 100
| filter kubernetes.namespace_name like /davmarti-kafka-sre/
| filter kubernetes.pod_name like /kafka-\d/