What’s the Best Way to Aggregate K8s Container Logs?

Promtail to an S3 backed Loki setup is a pretty solid approach for log aggregation!

There are a few tools that can help with this, like Promtail and Fluent-bit. I recommend using Fluent-bit in a daemonset configuration since it usually works better than running it as a sidecar. I mostly use daemonsets, and I've only set up sidecars for a couple of specific cases. Make sure your application logs are output through stdout and stderr; that way, the daemonset takes care of the rest.

I recently set up a similar tech stack and found that using Grafana + Loki + Fluent-bit is super simple and effective. It works well for aggregating logs!

We use Fluent-bit as a sidecar in our pods to aggregate logs. That's been working great alongside Splunk for us!

Alloy and Loki work nicely for us. We filter specific labels we want to log, and it does the job.