LoginSign Up
← Back to all sparks
R

rsyslog

INFRA · APIS
Velocity3.8

High-performance log processing and forwarding system

www.rsyslog.com ↗

The syslog daemon on every Linux box now collects Kubernetes logs itself

observabilitykuberneteslog-collectionopentelemetryqueueing
◆Current state
rsyslog's August scheduled-stable snapshot adds imkubernetes, an input module that tails pod and container logs directly, handles CRI and Docker json-file records, merges partial CRI lines, and enriches from the Kubernetes API. It lands alongside a segmented disk-assisted queue engine that becomes the default for new stores, a CloudWatch Logs output module, and generic per-action rate limiting in drop or pace mode.
◆Where it's heading
Three consecutive snapshots have pushed rsyslog out of its role as a local relay and toward being a full pipeline component: YAML config and native OpenTelemetry protobuf in April, an Elastic Beats input in June, a Kubernetes-native input now. The queue rewrite and rate limiting point at the same target, since those are the properties an edge collector needs to survive backpressure rather than what a syslog relay needs.
◆Prediction
Expect the next snapshot to harden imkubernetes against the operational cases the notes already hedge on, particularly ServiceAccount token refresh and API failover, and to push more deployments onto segmented queues by default.

◆Recent moves

  1. 14h ago

    rsyslog 8.2608.0 adds a Kubernetes log input and segmented disk queues

    ⚡ SPARK

    The snapshot that completes the arc the last two started: rsyslog stops merely annotating Kubernetes logs via mmkubernetes and starts collecting them via imkubernetes. Paired with a new segmented queue engine and per-action rate limiting, it is the release where the daemon acquires the parts an edge collector needs.

    View source ↗
  2. 1mo ago

    rsyslog 8.2606.0 adds Elastic Beats input and TCP compression

    The June snapshot that added an Elastic Beats input and TCP compression — the middle step between annotating container logs and collecting them, which the August release completes.

    View source ↗
  3. 3mo ago

    rsyslog 8.2604.0 adds YAML config and native OTel protobuf

    ⚡ SPARK

    The April snapshot that opened this arc: YAML configuration and native OpenTelemetry protobuf output moved rsyslog from syslog relay toward observability pipeline component.

    View source ↗
  4. 6mo ago

    rsyslog 8.2602.0 tag with no release notes

    A bare February tag carrying no notes in the feed. Nothing readable about direction here.

    View source ↗
  5. 7mo ago

    Marker tag for the AGENTS.md doc state at end of 2025

    A bookkeeping tag marking the documentation state before a docs iteration. No code change.

    View source ↗
  6. 8mo ago

    rsyslog 8.2512.0 tag with no release notes

    Another bare snapshot tag with no notes attached in the feed.

    View source ↗