Skip to content

Instantly share code, notes, and snippets.

Last active December 4, 2017 03:28
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?

下載 cli。

$ wget -O oklog
$ sudo chmod +x oklog


$ ./oklog query -h

用 kubectl 打條路到 oklog 的 pod。

$ ./kubectl port-forward -n tyd oklog-0 7650

用 -stats 預先試試看。

$ ./oklog query -from 1m -stats

grep 想要的 logs。

$ ./oklog query -from 1m | grep GIN

用 jq 搜尋 fluent-bit 加上的 k8s metadata。

$ ./oklog query -from 10m | jq -r '. | select(.Record.kubernetes.pod_name == "tpe-cloudops-api-1823622948-xrg9g") | .Record.log'

log 格式範例。

  "Time": 1510893109,
  "Record": {
    "kubernetes": {
      "annotations": {
        "\/config.hash": "bdb1d79ef92b1e36054236cfef9b5cfd",
        "\/config.mirror": "bdb1d79ef92b1e36054236cfef9b5cfd",
        "\/config.seen": "2017-11-04T03:31:20.665772279Z",
        "\/config.source": "file"
      "container_name": "kube-apiserver",
      "docker_id": "8f476a38d321513919b3ece963f3c95454eec6d1e679c221eacf9aa299589a29",
      "host": "",
      "namespace_name": "kube-system",
      "pod_id": "c3895306-c80a-11e7-830c-901b0e60defe",
      "pod_name": "kube-apiserver-"
    "log": "I1117 04:31:49.978160       1 wrap.go:42] GET \/api\/v1\/namespaces\/kube-system\/endpoints\/kube-scheduler: (1.210057ms) 200 [[hyperkube\/v1.7.0+coreos.0 (linux\/amd64) kubernetes\/8c1bf13\/leader-election]]\\n",
    "stream": "stderr",
    "time": "2017-11-17T04:31:49.978401165Z"

看過去十分鐘 pods 送 logs 的排行榜。

$ ./oklog query -from 10m | jq -r '. | .Record.kubernetes.pod_name' | sort | uniq -c | sort -nr

從單一 pod 抽取 logs 的小 script。 $ ./hawk kube-apiserver-

$ cat hawk 

./oklog query -from 10m | jq -r ". | select(.Record.kubernetes.pod_name == \"$1\") | .Record.log" | while read line
 echo $line
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment