Better Stack Kubernetes logging

Start logging in 2 minutes

Integrate Better Stack with your Kubernetes cluster using the Helm chart.

Helm

1. Add Helm repository

Add Better Stack Helm repository:

Add Helm repo
helm repo add betterstack-logs https://betterstackhq.github.io/logs-helm-chart
helm repo update

2. Set up Helm chart

Create values.yaml config file with the following contents:

Default Disabled TLS GKE Autopilot
vector:
  customConfig:
    sinks:
      better_stack_http_sink:
        uri: "https://$INGESTING_HOST/"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"

vector-aggregator:
  customConfig:
    sinks:
      better_stack_http_metrics_sink:
        uri: "https://$INGESTING_HOST/metrics"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"
# config with disabled TLS (e.g. for Minikube)
vector:
  customConfig:
    sinks:
      better_stack_http_sink:
        uri: "https://$INGESTING_HOST/"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"

vector-aggregator:
  customConfig:
    sinks:
      better_stack_http_metrics_sink:
        uri: "https://$INGESTING_HOST/metrics"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"
    sources:
      better_stack_kubernetes_metrics_nodes:
        tls:
          verify_certificate: false
          verify_hostname: false
      better_stack_kubernetes_metrics_pods:
        tls:
          verify_certificate: false
          verify_hostname: false

metrics-server:
  args:
    - --kubelet-insecure-tls
# config for GKE Autopilot cluster
vector:
  customConfig:
    sinks:
      better_stack_http_sink:
        uri: "https://$INGESTING_HOST/"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"

  # Disable persistence using a volume mount
  persistence:
    hostPath:
      enabled: false

  # Override default volumes and mounts to ensure only /var/log is mounted
  defaultVolumes:
    - name: var-log
      hostPath:
        path: /var/log
        type: DirectoryOrCreate
  defaultVolumeMounts:
    - name: var-log
      mountPath: /var/log
      readOnly: true

vector-aggregator:
  customConfig:
    sinks:
      better_stack_http_metrics_sink:
        uri: "https://$INGESTING_HOST/metrics"
        auth:
          strategy: "bearer"
          token: "$SOURCE_TOKEN"
    sources:
      better_stack_kubernetes_metrics_nodes:
        endpoint: "https://metrics-server.kube-system/apis/metrics.k8s.io/v1beta1/nodes"
        tls:
          verify_certificate: false
          verify_hostname: false
      better_stack_kubernetes_metrics_pods:
        endpoint: "https://metrics-server.kube-system/apis/metrics.k8s.io/v1beta1/pods"
        tls:
          verify_certificate: false
          verify_hostname: false

# Metrics server is already installed
metrics-server:
  enabled: false


3. Deploy the chart

Install the Better Stack chart:

Install Install without metrics server
helm install betterstack-logs betterstack-logs/betterstack-logs -f values.yaml
helm install betterstack-logs betterstack-logs/betterstack-logs -f values.yaml \
  --set metrics-server.enabled=false

Already have metrics server installed?

Install Better Stack chart without metrics server using code block above.
Alternatively, set metrics-server.enabled=false in values.yaml.

You should see your logs in Better Stack → Live tail.

Check out your metrics in the Kubernetes dashboard.

Kubernetes version 1.15 or higher is required.

You can customize the release name betterstack-logs to meet your naming conventions, but calling it vector or ending with -vector may lead to internal naming conflicts.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

Additional information

Interested in reading about installing and configuring Vector in more detail?
Check out the official Vector Kubernetes installation guide.

Want an overview of different tools for monitoring Kubernetes?
Head to comparison of best Kubernetes monitoring tools.

Filtering logs sent to Better Stack

Customize your Vector configuration by adding a Vector filter transform between the better_stack_http_sink sink and its original inputs:

values.yaml
vector:
  customConfig:
    sinks:
      better_stack_http_sink:
        uri: "https://$INGESTING_HOST/"
inputs: [better_stack_http_filter]
auth: strategy: "bearer" token: "$SOURCE_TOKEN"
transforms:
better_stack_http_filter:
type: "filter"
inputs: [better_stack_kubernetes_parser]
condition: .kubernetes.container_name == "my_important_container"