Skip to main content
In this lesson, we explore how to enhance your Kubernetes troubleshooting by displaying timestamps with the kubectl logs command and filtering log output by time. By incorporating timestamps, you gain valuable insight into when each log entry was generated, making it easier to diagnose issues effectively.

​
Displaying Timestamps with kubectl logs

To include timestamps in your pod logs, simply add the --timestamps flag. This flag appends the generation time to each log entry, providing vital context during troubleshooting.
For instance, when examining logs from an NGINX Ingress controller pod, you will see timestamps displayed alongside the application logs.
Using timestamps along with log output is particularly useful for correlating log entries with system events or errors.

​
Logs Without Timestamps

In some scenarios, your logging configuration might exclude timestamps. Consider the following example where log entries do not show timestamp information:
Even when log entries lack timestamps in the output, the container runtime retains the timestamp metadata. This metadata can be valuable for backend systems and further analysis. A similar case arises with application logs from a Notes app:
To integrate timestamps, re-run the command with the --timestamps flag.

​
Filtering Logs by Relative Time

In addition to appending timestamps, you can filter log outputs based on a specific timeframe using the --since flag. This capability assists in narrowing down log entries to a relevant period, saving time during troubleshooting. For example, if your pod generates logs every second and you need to inspect the logs from the past 5 seconds, you can run:
Below is an example output for a 5-second window:
You can easily extend the time window as necessary. To capture logs from the past 10 seconds (or even up to 1 hour), adjust the value provided to the --since flag accordingly. Below is an example capturing logs over a longer period:
Adjusting the --since flag allows you to tailor the log output to the exact timeframe you need for effective troubleshooting.

​
Summary

By adding the --timestamps flag to your kubectl logs command, you enrich your log data with temporal context, which is essential for diagnosing issues in real time. Additionally, leveraging the --since flag lets you filter logs to a specific duration, simplifying the process of pinpointing errors or warnings. For more detailed information on Kubernetes log management and best practices, refer to the Kubernetes Documentation.
Both flags are crucial in environments with high logging volumes where pinpointing the exact moment of an issue can lead to faster resolutions.

Watch Video