For some reasons, my kube cluster have put kube-apiserver log and kube-audit log into system journal log. I must make it more easy to read.
on the fist version I used sed instead of “ — output cat” option.
sed 's/.*\]: //'|grep -E ^{ | jq .This is the better way.
For kube-audit log ( json format):
$ sudo journalctl -u kube-apiserver.service --quiet --since='1min ago' --output cat | grep -E ^{ | jq .objectRef
{
"resource": "instancemanagers",
"namespace": "longhorn-system",
"name": "instance-manager-05b76682f4efe4513afe1b31dacffaf0",
"uid": "22517fb3-1eda-47a6-9e6f-dbef6300aecb",
"apiGroup": "longhorn.io",
"apiVersion": "v1beta2",
"resourceVersion": "12714",
"subresource": "status"
}
{
"resource": "instancemanagers",
"namespace": "longhorn-system",
"name": "instance-manager-d6ebad9e42c147b988e7fc26b2b5a5d3",
"uid": "aa6ffd1c-6754-494c-b063-61a808c4b03f",
"apiGroup": "longhorn.io",
"apiVersion": "v1beta2",
"resourceVersion": "182997",
"subresource": "status"
}
...
...
...For kube-apiserver log ( text):
$ sudo journalctl -u kube-apiserver.service --quiet --since='10min ago' --output cat | grep -vE ^{
I0814 07:40:18.076590 18907 handler.go:232] Adding GroupVersion metrics.k8s.io v1beta1 to ResourceManager
I0814 07:41:18.075969 18907 handler.go:232] Adding GroupVersion metrics.k8s.io v1beta1 to ResourceManager
I0814 07:42:18.075119 18907 handler.go:232] Adding GroupVersion metrics.k8s.io v1beta1 to ResourceManager
I0814 07:43:18.075835 18907 handler.go:232] Adding GroupVersion metrics.k8s.io v1beta1 to ResourceManager
I0814 07:43:18.366955 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta2 to ResourceManager
I0814 07:43:18.367075 18907 handler.go:232] Adding GroupVersion monitoring.coreos.com v1 to ResourceManager
I0814 07:43:18.371565 18907 handler.go:232] Adding GroupVersion getambassador.io v1 to ResourceManager
I0814 07:43:18.371642 18907 handler.go:232] Adding GroupVersion getambassador.io v2 to ResourceManager
I0814 07:43:18.371705 18907 handler.go:232] Adding GroupVersion getambassador.io v3alpha1 to ResourceManager
I0814 07:43:18.383339 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta2 to ResourceManager
I0814 07:43:18.392800 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta2 to ResourceManager
I0814 07:43:18.392937 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta1 to ResourceManager
I0814 07:43:18.411804 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta1 to ResourceManager
I0814 07:43:18.412056 18907 handler.go:232] Adding GroupVersion longhorn.io v1beta2 to ResourceManager
...
...
...refer: https://unix.stackexchange.com/questions/418349/print-only-timestamp-and-message-in-journalctl
