Log Aggregation in Kubernetes for Java Apps
Fast recall
Quick revision
Core answer
Understanding of how logging changes in a containerized, orchestrated environment
Writing logs to files inside containers — they're lost when the pod restarts
Explain node-level DaemonSet vs sidecar patterns, and when to use each
Interview-ready guide
Interview answer
In Kubernetes, the logging model shifts from application-managed log files to stdout/stderr — which means containers write to the console, the kubelet stores the output as node-local files, and a log shipping agent collects and forwards them to a central store.
How Kubernetes logging works
- Each container writes to stdout and stderr; the kubelet stores this as log files on the node under
/var/log/pods/;kubectl logs pod-namereads from these node-local files - Node-local log files are ephemeral — when a pod is evicted or the node is recycled, the logs are gone; centralized log aggregation must collect and forward logs before pods are replaced
The DaemonSet log shipping pattern
- A DaemonSet runs one Fluentd, Fluent Bit, or Filebeat pod per node — which means every log file on every node is shipped to the central log store as pods start and stop
- Fluent Bit is the most resource-efficient option for Kubernetes: low CPU and memory footprint; configures in a ConfigMap that mounts into the DaemonSet pods; forwards to Elasticsearch, Cloud Logging, or CloudWatch
Structured logs from Spring Boot
- Configure Spring Boot to output JSON to stdout — each log line is a JSON object; the Fluent Bit parser recognizes JSON and indexes fields without regex grok patterns
- Add Kubernetes metadata to log entries via Fluent Bit's Kubernetes filter: pod name, namespace, container name, and node name are added to every log entry automatically — which means
namespace = "production" AND pod_name =~ "orders-.*"filters logs from all pods in the orders deployment
Multi-line log handling
- Java stack traces span multiple lines — a single exception generates 20-50 log lines; without multi-line configuration in Fluentd/Fluent Bit, each line is indexed as a separate event, making stack traces unreadable
- Configure the multi-line parser to merge lines that start with whitespace (stack trace continuation lines) into one log event with the first line (the exception message) as the event start
Log Aggregation in Kubernetes for Java Apps
Direct Answer
In Kubernetes, each container writes to stdout/stderr, and the kubelet stores these as files on the node. Use a DaemonSet (Filebeat or Fluent Bit) to collect logs from all nodes and forward to Elasticsearch or a cloud logging service. Each log line is enriched with pod name, namespace, and node metadata.
Common Mistakes & Pitfalls
Writing logs to files inside containers — they're lost when the pod restarts
Check your understanding
Answer these without looking back at the article.
- What is the sidecar logging pattern and when would you use it over a DaemonSet?
- How do you handle log aggregation when pods are running in multiple namespaces?
- How do you set log retention in Kubernetes at the node level?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.