loki.source.kubernetes_events.md

---

title: loki.source.kubernetes_events

---

loki.source.kubernetes_events

loki.source.kubernetes_events tails events from the Kubernetes API and converts them into log lines to forward to other loki components.

Multiple loki.source.kubernetes_events components can be specified by giving them different labels.

Usage

loki.source.kubernetes_events "LABEL" {
  forward_to = RECEIVER_LIST
}

Arguments

The component starts a new reader for each of the given targets and fans out log entries to the list of receivers passed in forward_to.

loki.source.kubernetes_events supports the following arguments:

Name	Type	Description	Default	Required
job_name	string	Value to use for job label for generated logs.	"loki.source.kubernetes_events"	no
namespaces	list(string)	Namespaces to watch for Events in.	[]	no
forward_to	list(LogsReceiver)	List of receivers to send log entries to.		yes

By default, loki.source.kubernetes_events will watch for events in all namespaces. A list of explicit namespaces to watch can be provided in the namespaces argument.

NOTE: When watching all namespaces, Grafana Agent must have permissions to watch events at the cluster scope (such as using a ClusterRoleBinding). If an explicit list of namespaces is provided, Grafana Agent only needs permissions to watch events for those namespaces.

Log lines generated by loki.source.kubernetes_events have the following labels:

• namespace: Namespace of the Kubernetes object involved in the event.

• job: Value specified by the job_name argument.

• instance: Value matching the component ID.

If job_name argument is the empty string, the component will fail to load. To remove the job label, forward the output of loki.source.kubernetes_events to [a loki.relabel component][loki.relabel].

For compatibility with the eventhandler integration from static mode, job_name can be set to "integrations/kubernetes/eventhandler".

[loki.relabel]: {{< relref "./loki.relabel.md" >}}

Blocks

The following blocks are supported inside the definition of loki.source.kubernetes_events:

Hierarchy	Block	Description	Required
client	client	Configures Kubernetes client used to tail logs.	no
client > basic_auth	basic_auth	Configure basic_auth for authenticating to the endpoint.	no
client > authorization	authorization	Configure generic authorization to the endpoint.	no
client > oauth2	oauth2	Configure OAuth2 for authenticating to the endpoint.	no
client > oauth2 > tls_config	tls_config	Configure TLS settings for connecting to the endpoint.	no
client > tls_config	tls_config	Configure TLS settings for connecting to the endpoint.	no

The > symbol indicates deeper levels of nesting. For example, client > basic_auth refers to a basic_auth block defined inside a client block.

client block

The client block configures the Kubernetes client used to tail logs from containers. If the client block isn't provided, the default in-cluster configuration with the service account of the running Grafana Agent pod is used.

The following arguments are supported:

Name	Type	Description	Default	Required
api_server	string	URL of the Kubernetes API server.		no
kubeconfig_file	string	Path of the kubeconfig file to use for connecting to Kubernetes.		no
bearer_token	secret	Bearer token to authenticate with.		no
bearer_token_file	string	File containing a bearer token to authenticate with.		no
proxy_url	string	HTTP proxy to proxy requests through.		no
follow_redirects	bool	Whether redirects returned by the server should be followed.	true	no
enable_http2	bool	Whether HTTP2 is supported for requests.	true	no

At most one of the following can be provided:

• bearer_token argument.

• bearer_token_file argument.

• basic_auth block.

• authorization block.

• oauth2 block.

basic_auth block

{{< docs/shared lookup="flow/reference/components/basic-auth-block.md" source="agent" >}}

authorization block

{{< docs/shared lookup="flow/reference/components/authorization-block.md" source="agent" >}}

oauth2 block

{{< docs/shared lookup="flow/reference/components/oauth2-block.md" source="agent" >}}

tls_config block

{{< docs/shared lookup="flow/reference/components/tls-config-block.md" source="agent" >}}

Exported fields

loki.source.kubernetes_events does not export any fields.

Component health

loki.source.kubernetes_events is only reported as unhealthy if given an invalid configuration.

Debug information

loki.source.kubernetes_events exposes the most recently read timestamp for events in each watched namespace.

Debug metrics

loki.source.kubernetes_events does not expose any component-specific debug metrics.

Example

This example collects watches events in the kube-system namespace and forwards them to a loki.write component so they are written to Loki.

loki.source.kubernetes_events "example" {
  // Only watch for events in the kube-system namespace.
  namespaces = ["kube-system"]

  forward_to = [loki.write.local.receiver]
}

loki.write "local" {
  endpoint {
    url = env("LOKI_URL")
  }
}