References

Common fields in collected kubernetes container logs:

Name	Description
@timestamp	Time the log event occurred.
container.id	Runtime container ID.
container.image.name	Container image name (e.g., vllm/vllm-openai:latest ).
container.runtime	Container runtime (e.g., containerd ).
kubernetes.cluster.name	Kubernetes cluster name (e.g., prod-cluster-1 ).
kubernetes.cluster.org	Kubernetes cluster organization (e.g., example ).
kubernetes.container.name	Name of the container inside the pod.
kubernetes.namespace	Kubernetes namespace.
kubernetes.namespace_labels	Namespace labels.
kubernetes.pod.ip	IP address assigned to the pod.
kubernetes.pod.name	Name of the pod.
kubernetes.pod.uid	UID of the pod.

Name	Description
kubernetes.labels	Pod labels.
message	Log message content.
stream	Output stream (e.g., stdout , stderr ).

Common fields in collected kubernetes audit logs:

Name	Description
@timestamp	Time the log event occurred.
data_stream.dataset	Represent cluster name (e.g., prod-cluster-1 ).
data_stream.namespace	Represent cluster organization (e.g., example ).
data_stream.type	Datastream type (e.g., logs )
kubernetes.audit_log	Kubernetes audit log message content.