Kubernetes log monitoring

Dynatrace provides integrated Log management and analytics for your Kubernetes environments by either running the OneAgent Log module or integrating with log collectors such as Fluent Bit, Dynatrace OpenTelemetry Collector, Logstash, or Fluentd.

Use cases

Deployment options for Kubernetes log monitoring

Dynatrace provides a flexible approach to Kubernetes observability where you can pick and choose the level of observability you need for your Kubernetes clusters. The Dynatrace Operator manages all the components needed to get the data into Dynatrace for you. This also applies to collecting logs from Kubernetes containers. Depending on the selected observability option, the Dynatrace Operator configures and manages the Log module to work in conjunction with or without a OneAgent on the node.

Log monitoring value

Kubernetes platform monitoring (optional: + Application observability)

Kubernetes platform monitoring + Full-Stack observability

Auto discovery of container logs

Control ingest via annotations and labels

Log enrichment with Kubernetes metadata

Logs in context of traces

Log enrichment with process context

Report logs to different Dynatrace environments

Dynatrace Operator for managing the rollout and lifecycle

Log module integrates with OneAgent on node

For pods with Application observability enabled

Dynatrace version 1.310+
Dynatrace Operator version 1.4.2+
Dynatrace OneAgent version 1.309+

Before you begin

Before installing Dynatrace on your Kubernetes cluster, ensure that you meet the following requirements:

Your kubectl CLI is connected to the Kubernetes cluster that you want to monitor.
You have sufficient privileges on the monitored cluster to run kubectl or oc commands.

Cluster setup and configuration

You must allow egress for Dynatrace pods (default: Dynatrace namespace) to your Dynatrace environment URL
For OpenShift Dedicated, you need the cluster-admin role
Helm installation Use Helm version 3

Supported versions

See supported Kubernetes/OpenShift platform versions and distributions.

The OneAgent Log Module is not yet supported on GKE Autopilot clusters.

The OneAgent Log module reads logs from containerd and cri-o containers. Other container runtimes aren't supported.

Installation options

Kubernetes and OpenShift (with future support for GKE Autopilot) are automatically detected during the installation. The necessary manifests are applied as required. Follow the steps below:

Install Dynatrace Operator

helm install dynatrace-operator oci://public.ecr.aws/dynatrace/dynatrace-operator \
   --set "csidriver.enabled=false"
   --create-namespace \
   --namespace dynatrace \
   --atomic

Edit the values.yaml sample from GitHub, and then run the install command, passing the YAML file as an argument:

helm install dynatrace-operator oci://public.ecr.aws/dynatrace/dynatrace-operator \
   --create-namespace \
   --namespace dynatrace \
   --atomic \
   -f values.yaml

Create secret for access tokens

Create a secret named dynakube for the Dynatrace Operator token and data ingest token obtained in Tokens and permissions required.
```
kubectl -n dynatrace create secret generic dynakube --from-literal="apiToken=<OPERATOR_TOKEN>" --from-literal="dataIngestToken=<DATA_INGEST_TOKEN>"
```

Create your DynaKube custom resource YAML file.

You can review the available parameters or how-to guides, and adapt the DynaKube custom resource according to your requirements.

apiVersion: dynatrace.com/v1beta3
kind: DynaKube
metadata:
  name: dynakube
  namespace: dynatrace
#  annotations:
#    feature.dynatrace.com/oneagent-privileged: "true" # Required on Openshift
spec:
  # Link to api reference for further information: https://docs.dynatrace.com/docs/ingest-from/setup-on-k8s/reference/dynakube-parameters

  apiUrl: https://ENVIRONMENTID.live.dynatrace.com/api

  metadataEnrichment:
    enabled: true

  logMonitoring: {}

  activeGate:
    capabilities:
      - kubernetes-monitoring
    resources:
      requests:
        cpu: 500m
        memory: 512Mi
      limits:
        cpu: 1000m
        memory: 1.5Gi
  templates:
    logMonitoring:
      imageRef:
        repository: public.ecr.aws/dynatrace/dynatrace-logmodule
        tag: <tag>
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
          operator: Exists

To retrieve the <tag> version for the logMonitoring template:

Go to the ECR Public Gallery.
Select Image tabs, and use one of the versions. For example, 1.311.70.20250416-094918.

Apply the DynaKube custom resource

Run the command below to apply the DynaKube custom resource, making sure to replace <your-DynaKube-CR> with your actual DynaKube custom resource file name. A validation webhook will provide helpful error messages if there's a problem.
```
kubectl apply -f <your-DynaKube-CR>.yaml
```

optional Verify deployment

Verify that your DynaKube is running and all pods in your Dynatrace namespace are running and ready.

> kubectl get dynakube -n dynatrace
NAME         APIURL                                          STATUS     AGE
dynakube     https://<ENVIRONMENTID>.live.dynatrace.com/api  Running    45s

In a default DynaKube configuration, you should see the following pods:

> kubectl get pods -n dynatrace
NAME                                  READY   STATUS    RESTARTS   AGE
dynakube-activegate-0                 1/1     Running   0          55s
dynakube-logmonitoring-grrnd          1/1     Running   0          55s
dynakube-logmonitoring-ptjgk          1/1     Running   0          55s
dynakube-logmonitoring-rtc2p          1/1     Running   0          55s
dynatrace-oneagent-csi-driver-2twgv   4/4     Running   0          5m
dynatrace-oneagent-csi-driver-jbwdv   4/4     Running   0          5m
dynatrace-oneagent-csi-driver-t68tt   4/4     Running   0          5m
dynatrace-operator-74dbb44b57-g58mn   1/1     Running   0          5m
dynatrace-webhook-59b69958d6-82wlr    1/1     Running   0          5m
dynatrace-webhook-59b69958d6-d9vqd    1/1     Running   0          5m

As the OneAgent Log module is deployed as DaemonSet you should have a Log monitoring pod on each node.

Licensing

Kubernetes Log monitoring requires Dynatrace Platform Subscription (DPS) and is licensed by the ingested gibibyte (GiB) volume.

Control log ingest with Kubernetes metadata

You can configure log ingestion rules in Dynatrace to control which logs should be collected from your Kubernetes environment. The rules leverage Kubernetes metadata and other common log entry attributes to determine which logs are to be ingested. The standard log processing features from OneAgent, including sensitive data masking, timestamp configuration, log boundary definition, and automatic enrichment of log records, are also available for Kubernetes logs.

See Stream Kubernetes logs with OneAgent Log Module for a detailed description, use cases, and REST API examples.