Simple Vector Kubernetes logs

[jicefrost]

I just deployed simplest vector config, just for collect Kubernetes logs and debug them in to console. The goal is collect logs from stdout. Later it will send logs to logstash. Its deploy with helm as daemonset. So the code simple -

[sources.kubernetes_logs]
type = "kubernetes_logs"
self_node_name = "${HOSTNAME}"  # 
include_paths_glob_patterns = ["/var/log/containers/*.log"]

and for the output -

[sinks.console]
type = "console"
inputs = ["kubernetes_logs"]
encoding.codec = "json"

So Vectors pods actually runs without any errors. Logs is

kubectl -n kube-system logs vector-rztqn
2025-05-23T18:31:58.303266Z  INFO vector::app: Log level is enabled. level="info"
2025-05-23T18:31:58.437029Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.toml"]
2025-05-23T18:32:03.206346Z  WARN vector::config: Source has acknowledgements enabled by a sink, but acknowledgements are not supported by this source. Silent data loss could occur. source="kubernetes_logs" sink="logstash_www_access"
2025-05-23T18:32:04.275158Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Obtained Kubernetes Node name to collect logs for (self). self_node_name="vector-rztqn"
2025-05-23T18:32:04.677728Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Including matching files. ret=["/var/log/containers/*.log"]
2025-05-23T18:32:04.677813Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Excluding matching files. ret=["**/*.gz", "**/*.tmp"]
2025-05-23T18:32:05.892880Z  INFO vector::topology::running: Running healthchecks.
2025-05-23T18:32:05.893223Z  INFO vector::topology::builder: Healthcheck passed.
2025-05-23T18:32:05.893402Z  INFO vector::topology::builder: Healthcheck passed.
2025-05-23T18:32:05.894034Z  INFO vector: Vector has started. debug="false" version="0.46.1" arch="x86_64" revision="9a19e8a 2025-04-14 18:36:30.707862743"
2025-05-23T18:32:05.894111Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2025-05-23T18:32:06.071512Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: file_source::checkpointer: Attempting to read legacy checkpoint files.

and there is nothing more. No logs at console, but few new logs actually appears every minute at /var/log/containers/. Have rights to access files. May some one tell me what i'm doing wrong?

[pront]

Hi @jicefrost, what's the output of

kubectl -n kube-system exec -it vector-rztqn -- ls /var/log/containers

Do you see new logs being added there?
Also, make sure your Vector process can read from those directories.