Logs

Kubernetes logs from one container, a whole workload or an application, in one view

PodSteer streams one container, every container in a pod, or every pod of a workload or an application as one view, each pod's lines marked in its own colour. It filters by level with a count on each, draws a volume histogram you can click to jump through, and searches with the same syntax as its tables, regular expressions included.

What one view can hold

  • One container, or all of a pod's containers — one stream each, as kubectl logs --all-containers opens them, so a sidecar is never silently skipped.
  • Every pod of a Deployment or another workload, merged, with each line prefixed by its pod.
  • Every pod of an application, found by its app.kubernetes.io/instance label.
  • The previous container's logs, for the run that crashed.
  • Follow, the last 100, 500, 1,000 or 5,000 lines, and everything since 5 minutes, 15 minutes, 1, 6 or 24 hours ago.

Reading a busy stream

Search marks matches where they are, with a ruler down the edge showing where they fall in the whole stream; the filter control collapses the view to the matching lines when that is what you want. re: and /pattern/ give regular expressions, exactly as in a table's search field.

  • Level chips for error, warn, info, debug and lines with no recognisable level, each with its count.
  • A volume histogram of where the lines cluster in time: click a bar to jump there.
  • JSON and logfmt lines parsed, with level, message and timestamp promoted to the front.
  • Stack traces grouped under the line that started them.
  • Timestamps shown local, in UTC, relative or not at all, switched without re-reading the stream.
  • A maximised view with a minimap that marks every match.

Keeping what you read

Copy the lines on screen, pod prefixes included, or save either the filtered view or the whole buffered stream through your system's save dialog. Logs are held in memory and written nowhere unless you save them.

What it does not do.

  • It is not a log store. It reads what the kubelet still holds, so logs rotated away or belonging to deleted pods are gone, as they are for kubectl.
  • One view holds the newest 10,000 lines; older lines leave the top as new ones arrive.
  • A multi-pod view opens at most 40 streams at once.
  • Previous logs are the one earlier run Kubernetes keeps for each container, nothing older.
  • Logs from different clusters are not merged into one view.

Cluster assessment

Ranked findings instead of a pod list: crash loops, OOM kills, pods that will never schedule, sizing problems — each with what to do about it.

Shells and terminals

Exec, debug containers, node shells, an in-cluster shell and your own local terminal — with the pods PodSteer creates cleaned up after.

Multi-cluster

Real tabs, one cluster each; one table across every open cluster; clusters found through your own cloud CLI.