Viewing Kubernetes Logs in Centralized Cloud Logging

Purpose

This Knowledge Base article explains how to view Kubernetes application logs using centralized cloud logging tools, without manually checking individual pods.

It covers:

• Viewing entire namespace logs
• Viewing container / deployment-level logs
• Avoiding pod-by-pod log inspection
• Best practices for scalable log monitoring

The guide applies to Kubernetes clusters running on:

• Azure Kubernetes Service (AKS)
• Google Kubernetes Engine (GKE)
• Amazon Elastic Kubernetes Service (EKS)
• Oracle Kubernetes Engine (OKE)

Prerequisites

We need to enable the following logging configuration in values.yaml to access logs in the console.We need to enable below Logging part in values.yaml for access the logs in console.

logging:
 level: "both"      # info | error | both
 output: "console"  # console | file | both 

Scope

This article is intended for:

• Kubernetes administrators
• DevOps / SRE teams
• Cloud operations engineers
• Support teams performing RCA (Root Cause Analysis)

Key Concept: How Centralized Logging Works in Kubernetes

In Kubernetes:

1. Applications write logs to stdout / stderr
2. A logging agent (such as Fluent Bit, Fluentd, or a cloud-native agent) runs as a DaemonSet
3. Logs are collected from all nodes
4. Logs are shipped to the cloud provider’s centralized logging service
5. Logs are automatically enriched with metadata:
   • Namespace
   • Pod name
   • Container name
   • Deployment / workload labels

Result

You can search, filter, and visualize logs at namespace or container level — without referencing individual pods.

Common Log Dimensions (Across All Cloud Providers)

These fields make centralized logging scalable and searchable.

Azure (AKS) – Log Analytics

Centralized Logging Tool

Azure Monitor → Log Analytics Workspace

Prerequisites

• Container Insights enabled for AKS
• Logs stored in Log Analytics

View Logs for an Entire Namespace

ContainerLog
| where Namespace == "my-namespace"
| order by TimeGenerated desc 

View Logs for a Specific Container (Deployment Level)

ContainerLog
| where Namespace == "my-namespace"
| where ContainerName == "api-service"
| order by TimeGenerated desc 

✔ Shows logs from all pods of that container

View Logs for a Deployment (Using Pod Name Pattern)

ContainerLog
| where Namespace == "my-namespace"
| where PodName startswith "orders-api" 

UI Navigation

Azure Portal → Azure Monitor → Logs → Select Log Analytics Workspace

Choose logs and run the ContainerLogV2 as shown below

Add the tags and apply the filter

Google Cloud (GKE) – Cloud Logging (Logs Explorer)

Centralized Logging Tool

Google Cloud → Operations → Logging → Logs Explorer

Prerequisites

• Cloud Logging enabled (default for GKE)

View Logs for an Entire Namespace

resource.type="k8s_container"
resource.labels.namespace_name="my-namespace" 

View Logs for a Container (Deployment Level)

resource.type="k8s_container"
resource.labels.namespace_name="my-namespace"
resource.labels.container_name="api-service" 

✔ Automatically aggregates logs from all replicas.

View Logs by Workload (Deployment)

labels.k8s-pod/app="orders-api" 

UI Navigation

Google Cloud Console → Operations → Logging → Logs Explorer

Chose the Project

Choose the Logs Explorer

Choose the resources

Choose the cluster name and namespace

Download the logs as shown below

AWS (EKS) – Amazon CloudWatch Logs

Centralized Logging Tool

Amazon CloudWatch Logs

Prerequisites

• CloudWatch Container Insights enabled
• Fluent Bit / CloudWatch agent installed

Log Group

/aws/containerinsights/<cluster-name>/application 

View Logs for an Entire Namespace

fields @timestamp, @message
| filter kubernetes.namespace_name = "my-namespace"
| sort @timestamp desc 

View Logs for a Container (Deployment Level)

fields @timestamp, @message
| filter kubernetes.namespace_name = "my-namespace"
| filter kubernetes.container_name = "api-service"
| sort @timestamp desc 

View Logs by Deployment

| filter kubernetes.pod_name like /orders-api/ 

UI Navigation

AWS Console → CloudWatch → Logs → Logs groups

Choose logs -> Logs groups - > choose the group

Run the query

You can see the logs as shown below log events and you can download logs from Actions

Oracle Cloud (OKE) – OCI Logging

Centralized Logging Tool

OCI Console → Observability & Management → Logging

Prerequisites

• OCI Logging enabled - LogsMonitoring document

View Logs for an Entire Namespace

kubernetes.namespace = "my-namespace" 

View Logs for a Container (Deployment Level)

kubernetes.namespace = "my-namespace"
kubernetes.container_name = "api-service" 

View Logs by Deployment

kubernetes.pod_name startsWith "orders-api" 

UI Navigation

OCI Console → Observability & Management → Logging → Search Logs

Click the navigation menu

Choose the Observability & Management

Choose the namespace and view the logs

Download the logs as shown below