How to send Kubernetes Logs to VMware Aria Operations for Applications Logs

Products

• Insights

Issue/Introduction

This article outlines how to ingest Kubernetes Logs to VMware Aria Operations for Applications Logs, using Kubernetes Operator approach.

Environment

• Data Ingestion
• Product edition: VMware Aria Operations for Applications Current Release
• Feature Category: Logs 

Resolution

Overview of Wavefront Operator for Kubernetes

The Wavefront Operator for Kubernetes supports deploying the Wavefront Collector and the VMware Aria Operations for Applications Proxy in Kubernetes.

Prerequisites

The following tools are required for installing the integration.

• kubectl

Deploy the Wavefront Collector and Proxy with the Operator

• Install the Wavefront Operator intoobservability-systemnamespace.

  Note: If you already have VMware Aria Operations for Applications installed via helm or manual deploy, uninstall before you install the operator.

kubectl apply -f https://raw.githubusercontent.com/wavefrontHQ/wavefront-operator-for-kubernetes/main/deploy/kubernetes/wavefront-operator.yaml

• Create a Kubernetes secret with your VMware Aria Operations for Applications API token. See Managing API Tokens page.

kubectl create -n observability-system secret generic wavefront-secret --from-literal token=YOUR_WAVEFRONT_TOKEN

• Create awavefront.yamlfile with your Wavefront Custom Resource configuration.

• Add the configuration for logging to thewavefront.yamlfile, for example:

# Need to change YOUR_CLUSTER_NAME, YOUR_WAVEFRONT_URL accordingly
apiVersion: wavefront.com/v1alpha1
kind: Wavefront
metadata:
  name: wavefront
  namespace: observability-system
spec:
  clusterName: YOUR_CLUSTER_NAME
  wavefrontUrl: YOUR_WAVEFRONT_URL
  dataCollection:
    metrics:
      enable: true
    logging:
      enable: true
  dataExport:
    wavefrontProxy:
      enable: true

• Deploy the Wavefront Collector and Proxy with your configuration

kubectl apply -f <path_to_your_wavefront.yaml>

• Run the following command to get status for the Wavefront integration:

kubectl get wavefront -n observability-system

The command should return a table like the following, displaying Operator instance health:

NAME        STATUS    PROXY           CLUSTER-COLLECTOR   NODE-COLLECTOR   LOGGING        AGE    MESSAGE
wavefront   Healthy   Running (1/1)   Running (1/1)       Running (3/3)    Running (3/3)  2m4s   All components are healthy

IfSTATUSisUnhealthy, check troubleshooting.

With the previous steps logs should start flowing to your cluster.

Find and Examine Logs in the Logs Browser

The Logs Browser supports in-depth exploration of your logs. As a user with the Logs permission, you can zoom into a time window, and you can filter and search your logs, so that you see exactly what you’re interested in.

To use the Logs Browser:

1. In a web browser, log in to your VMware Aria Operations for Applications instance as user with the Logs permission.
2. On the toolbar, click Logs (Beta).

In the following scenario recently, deployed app is not working, the following error is received. 

Pods shows as healthy:

Checking Logs, a Redis error from frontend pod is received:

For additional information for Logs browser and more capabilities available check:

Get Started with the Logs Browser