2

There is an official manifest for the deployment of the daemonset https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/elasticsearch/fluent-bit-ds.yaml

Line 49 defines the volume varlibdockercontainers.

I don't understand why the Fluent-bit needs to read data from the folder /var/lib/docker/containers.

Maksim
  • 197
  • 2
  • 12
  • Note that soon Kubernetes will stop using and supporting Docker. Containerd is not using `/var/lib/docker/containers`. So in the future, or if you are already using containerd, this mount will not be necessary. – trallnag Mar 26 '22 at 17:23

1 Answers1

4

I don't understand why the Fluent-bit needs to read data from the folder /var/lib/docker/containers.

Because that is where docker stores its ${container_id}-json.log file when using the json-file logging driver, which is (AFAIK) the default. There are more details in this related question

Therefore, in order for fluent to transmit logs, it does (effectively) tail -f $the_log_filename | jq -r .log and those are the container's logs. If you want to see the actual implementation, it seems to be in docker.h and its docker.c peer

mdaniel
  • 31,240
  • 5
  • 55
  • 58