K8S EFK (especially Fluentd) daemonset for docker journald logging driver

docker log driver journald send docker logs to systemd-journald.service

so, we need to make systemd-journald persistent save to /var/log/journal

edit /etc/systemd/journald.conf:

...[Journal]Storage=persistent#Compress=yes...

then restart to apply changes:

systemctl restart systemd-journaldls -l /var/log/journal

as /var/log has been mounted into fluentd pod, its all done, restart fluentd pod it works for me @202104.

by the way, i am using fluentd yaml from:

and the env FLUENTD_SYSTEMD_CONF value should not be disable

CodeHunter