// solution / kubernetes logging
Kubernetes logging with Graylog
Containers are short-lived. Their logs should not be. We build the collection pipeline from your clusters into Graylog so every log line arrives with the context needed to find it later.
// pipeline
From container stdout to a searchable stream
- 01 Container runtime /var/log/containers/*.log
- 02 Collector DaemonSet Fluent Bit · OTel Collector · Filebeat
- 03 Metadata enrichment namespace · pod · container · labels
- 04 Transport GELF · OTLP · Beats over TLS
- 05 Graylog inputs load-balanced, journaled
- 06 Streams & index sets retention per namespace or team
Collection inside the cluster
Container runtimes write stdout and stderr to files on each node. A collector running as a DaemonSet tails those files, adds Kubernetes metadata from the API server — namespace, pod, container, labels — and ships events to Graylog.
Common choices are Fluent Bit (GELF output), the OpenTelemetry Collector (OTLP to Graylog's OpenTelemetry input in recent versions) or Filebeat (Beats input). We pick based on what else runs in your clusters: if you already operate an OpenTelemetry pipeline for traces and metrics, logs should usually follow the same path.
Where Graylog itself should run
Graylog can run inside Kubernetes, but its stateful dependencies — the search layer and MongoDB — need careful storage and disruption handling. For many teams it is simpler and more resilient to run Graylog on dedicated VMs or servers outside the clusters it observes.
That separation has another benefit: when a cluster is having a bad day, the platform you use to investigate it is not affected by the same problem.
Making container logs searchable
Structured JSON logs are parsed into fields; unstructured logs are handled with processing pipeline rules. Multiline stack traces are joined at the collector, not after the fact. Noisy namespaces can be routed to index sets with shorter retention so they do not crowd out what matters.
// faq
Kubernetes logging questions
Should Graylog run inside Kubernetes?
It can, but for most teams we recommend running the Graylog platform on dedicated VMs or servers and collecting from Kubernetes with DaemonSets. It separates the observer from the observed and keeps stateful components simpler.
Which collector should we use?
Fluent Bit is lightweight and widely used. The OpenTelemetry Collector makes sense if you are standardising on OpenTelemetry. Filebeat fits environments already using Beats. All three can feed Graylog.
Can we separate logs per team or namespace?
Yes. Streams route messages by namespace, label or any field, and index sets give each stream its own retention. Access can then be scoped per stream.
You have logs. We build and operate the infrastructure that makes them useful.
Tell us about your environment. An engineer will reply with a first architecture outline.