EKS Logs
Amazon EKS clusters normally ship container and control-plane logs with Fluent Bit, writing them into an S3 bucket. The AWS EKS Logs template reads that bucket the same way the other AWS templates do — the bucket raises an S3 notification, the notification lands on an SQS queue, and the platform consumes the queue — so the cluster keeps its existing Fluent Bit output and Fluency picks the objects up from storage rather than from the cluster.
AWS-side setup
Fluent Bit output
The cluster keeps its existing Fluent Bit deployment; configure its S3 output (bucket, prefix and rotation) per the aws-for-fluent-bit documentation. The streams worth shipping are container stdout/stderr and, where it is enabled, the control-plane audit log.
S3 notification and SQS queue
The bucket must notify an SQS queue on object creation. This is the same wiring as every other S3-delivered AWS source; see S3 Notification for the bucket policy, the queue policy, and the notification configuration.
Access
Either register a role under Platform → Integrations and select it in the form, or create an IAM user and supply its access key and secret. Prefer the role.
Install the Application
Go to Platform → Applications → Install Application From Template and choose AWS EKS Logs from the AWS Services category. (Earlier releases listed the same template as EKS Logs; the template ID, AWSFluentbitS3, did not change.) The form asks for:
| Parameter | Notes |
|---|---|
| AWS Region | Drop-down, opens on US N.Virginia. The region the queue lives in. |
| SQS notification queue url | The full queue URL, not the ARN. |
| Pre-defined AWs Role | Optional. A role registered on Platform → Integrations. |
| IAM access key | Optional. Use instead of a role, not as well as. |
| IAM access secret | Optional. |
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled default — change it. Leaving it at default on more than one application will collide, and the second install aborts. |
Press Install. The application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
Related
- AWS — the other AWS sources.
- S3 Notification — the bucket-to-queue wiring shared by these templates.
- AWS CloudTrail and Amazon CloudWatch — the same delivery path for other AWS log types.