Where do the log files live in a K8s cluster using the Containerd runtime?

Question

I'm using the AKS cluster with version 1.19, and I found that this version of K8s using Containerd instead of Dockershim as the container runtime. I also use Fluentd to collect logs from my spring apps, with k8s version 1.18 it works okay, but with k8s version 1.19 I can't collect logs from my spring app. I use this file for my Fluentd DeamonSet. I wonder if the log files of my applications are not lived in var/log/containers, is this correct?

Answer 1

I found a solution here: use-cri-parser-for-containerdcri-o-logs

By default, these images use json parser for /var/log/containers/ files because docker generates json formatted logs. On the other hand, containerd/cri-o use different log format. To parse such logs, you need to use cri parser instead.

We need to build a new fluentd image using cri parser, that works for me.