Skip to content

Conversation

@elohmeier
Copy link
Contributor

@elohmeier elohmeier commented Jan 6, 2026

Summary

This PR adds a new kubernetes_events source that watches the Kubernetes Events API and emits each event as a Vector log event. This addresses a long-standing feature request and brings Vector closer to feature parity with other observability tools in the Kubernetes ecosystem.

The design is influenced by similar implementations in:

Key features:

  • Watches the modern events.k8s.io/v1 API (not the deprecated core/v1 Event API)
  • Supports namespace filtering, field selectors, and label selectors
  • Filters by event type (Warning, Normal), reason, and involved object kind
  • Built-in deduplication to handle Kubernetes event replay on API reconnection
  • Configurable max event age to skip stale events on startup
  • Optional inclusion of previous event state for change tracking
  • Designed for singleton deployment (one instance per cluster)

We've been using this in Production in various clusters for some weeks now and it has been working fine.

Vector configuration

sources:
  k8s_events:
    type: kubernetes_events
    namespaces:
      - kube-system
      - default
    include_types:
      - Warning
    max_event_age_seconds: 3600

sinks:
  console:
    type: console
    inputs:
      - k8s_events
    encoding:
      codec: json

How did you test this PR?

  • Unit tests for deduplication logic, event timestamping, and filtering
  • Manual testing against a local Kubernetes cluster (kind/minikube)
  • Verified event streaming, reconnection handling, and deduplication behavior

Change Type

  • Bug fix
  • New feature
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

@elohmeier elohmeier requested review from a team as code owners January 6, 2026 10:45
@github-actions github-actions bot added domain: sources Anything related to the Vector's sources domain: external docs Anything related to Vector's external, public documentation labels Jan 6, 2026
@maycmlee maycmlee self-assigned this Jan 6, 2026
Copy link
Contributor

@maycmlee maycmlee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some small suggestions!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: external docs Anything related to Vector's external, public documentation domain: sources Anything related to the Vector's sources

Projects

None yet

Development

Successfully merging this pull request may close these issues.

New kubernetes_system_events source

2 participants