Collect logs with a sidecar

Prerequisites

Ensure that you have:

• Created an ACK Serverless clusterACK Serverless cluster is created.

• SLS is activated. When you first log on to the SLS console, follow the on-page prompts to activate the service if prompted.SLS console.

How it works

The Logtail sidecar shares a Kubernetes volume with the application container inside each ECI instance. The application writes logs to the volume; Sidecar log collection uses Logtail. Logtail must share the application's log directory; the application writes logs to the shared volume, and Logtail monitors file changes in that directory.

Two log types:

Step 1: Deploy the sidecar container

Create a Deployment with the application container and the Logtail sidecar container.

The YAML uses an nginx log generator as the application container and mounts both volume types.

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx-log-sidecar-demo
  name: nginx-log-sidecar-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-log-sidecar-demo
  template:
    metadata:
      labels:
        app: nginx-log-sidecar-demo
    spec:
      containers:
        - name: nginx-log-demo
          image: registry-vpc.${RegionId}.aliyuncs.com/log-service/docker-log-test:latest
          command:
            - /bin/mock_log
          args:
            - '--log-type=nginx'
            - '--stdout=false'
            - '--stderr=true'
            - '--path=/var/log/nginx/access.log'
            - '--total-count=100000000'
            - '--logs-per-sec=100'
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /var/log/nginx
              name: nginx-log           # Text file logs: shared emptyDir volume
        - name: logtail
          image: registry-vpc.${RegionId}.aliyuncs.com/log-service/logtail:latest
          env:
            - name: ALIYUN_LOGTAIL_USER_ID
              value: "${Aliuid}"
            - name: ALIYUN_LOGTAIL_USER_DEFINED_ID
              value: nginx-log-sidecar
            - name: ALIYUN_LOGTAIL_CONFIG
              value: /etc/ilogtail/conf/${RegionId}/ilogtail_config.json
            - name: aliyun_logs_machinegroup
              value: k8s-group-app-alpine
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /var/log/nginx
              name: nginx-log           # Text file logs: same emptyDir volume as the app container
            - mountPath: /stdlog
              name: stdlog             # Standard output logs: ECI stdlog volume
      volumes:
        - emptyDir: {}
          name: nginx-log              # Shared volume for text file logs
        - name: stdlog                 # ECI stdlog volume for standard output logs
          flexVolume:
            driver: alicloud/pod-stdlog

Replace these placeholders before applying:

After applying, verify all containers are running:

kubectl get pods -l app=nginx-log-sidecar-demo

Expected output — each pod should show 2/2 Running:

NAME                                      READY   STATUS    RESTARTS   AGE
nginx-log-sidecar-demo-84587d9796-krn5z   2/2     Running   0          32m
nginx-log-sidecar-demo-84587d9796-vhnld   2/2     Running   0          32m

If a pod shows 1/2, run kubectl describe pod <pod-name> to check events.

You can also view logs with kubectl or the ECI console:

• View logs with kubectl

  

• View logs in the ECI console

  

Step 2: Configure Logtail to collect logs

Create a Logtail configuration in the SLS console to collect logs from the sidecar.

1. Log on to the SLS console.

2. Click the Quick Data Import card. In the Import Data dialog box, click Regular Expression - Text Logs.

3. Select a Project and Logstore, then click Next. If you do not have one, click Create Now.

   SLS automatically creates a Project named k8s-log-{K8s-Cluster-ID} per Kubernetes cluster.

4. Configure the machine group and click Next.

   • Scenario: Select Kubernetes Clusters.

   • Deployment Method: Select Sidecar.

   • Select Machine Group: Select the target machine group from Source Machine Group and move it to Applied Server Groups. If none exists, click Create Machine Group.

5. Configure Logtail and click Next. Logtail supports modes including single-line, regex, separator, and JSON. See Collect logs from hosts. Use these settings based on log type: Standard output Log path: the stdlog volume mount in the sidecar (/stdlog). To add a plug-in, see Process data during collection (processing plug-ins). Text files Log path: the shared emptyDir volume mount in the sidecar. To add a plug-in, see Process data during collection (processing plug-ins).

   Configuration section	Parameter	Value
   Global Configurations	Configuration Name	stdout
   Input Configurations	Logtail Deployment Mode	Text Log Collection
   	File Path	/stdlog/**/*.log
   Processor Configurations	Processing Method	None

   Configuration section	Parameter	Value
   Global Configurations	Configuration Name	file
   Input Configurations	Logtail Deployment Mode	Text Log Collection
   	File Path	/var/log/nginx/**/*.log
   Processor Configurations	Processing Method	None

6. Configure query and analysis settings. Indexes are configured by default. To reconfigure, see Configure indexes.

7. Verify that SLS is collecting logs. After the configuration, SLS starts collecting ECI logs. If no logs appear after a few minutes, check:

   • The Logtail container is running (READY 2/2 in the pod).

   • The file path in the Logtail configuration matches the volume mount path in the pod spec.

   • The machine group in the Logtail configuration matches the aliyun_logs_machinegroup value set in the Logtail container's environment variables.