What kubectl command can I use to get events sorted by specific fields and print only specific details of events?

Question

I need to print only specific fields of Kubernetes Events, sorted by a specific field.

This is to help me gather telemetry and analytics about my namespace

How could I do that?

Sally

#45310787 (my answer: kubectl alpha events https://mcmap.net/q/150296/-kubernetes-sort-pods-by-age-closed) – Drisko

Answer 1

kubectl get events --sort-by='.lastTimestamp'

Lustrous

in case this throws an error, try this kubectl get events --sort-by=.metadata.creationTimestamp. – Lamprophyre

Answer 2

Following command does it.

It prints the events sorted by timestamp of creation.

It also users go-template to filter out specific fields of the kubernetes-event object.

kubectl get events  --sort-by='.metadata.creationTimestamp'  -o 'go-template={{range .items}}{{.involvedObject.name}}{{"\t"}}{{.involvedObject.kind}}{{"\t"}}{{.message}}{{"\t"}}{{.reason}}{{"\t"}}{{.type}}{{"\t"}}{{.firstTimestamp}}{{"\n"}}{{end}}'

Sally

Answer 3

I am using the following command to sort it after timestamp

kubectl get event --all-namespaces --sort-by='.metadata.managedFields[0].time'

For filtering out the information you can of course combine it with the go-template described by @suryakrupa or with jq described by @Chris Stryczynski

Alcorn

Answer 4

If you don't mind seeing the output as JSON:

kubectl get event -o json | jq '.items |= sort_by(.lastTimestamp)'

This requires jq.

Furriery

Answer 5

Here's the Bash function I use:

function kubectl-events {
    {
        echo $'TIME\tNAMESPACE\tTYPE\tREASON\tOBJECT\tSOURCE\tMESSAGE';
        kubectl get events -o json "$@" \
            | jq -r  '.items | map(. + {t: (.eventTime//.lastTimestamp)}) | sort_by(.t)[] | [.t, .metadata.namespace, .type, .reason, .involvedObject.kind + "/" + .involvedObject.name, .source.component + "," + (.source.host//"-"), .message] | @tsv';
    } \
        | column -s $'\t' -t \
        | less -S
}

You can use it like: kubectl-events -A, kubectl-events -n foo, etc.

Refusal

But what is "oc" referring to? – Vapory

Haha good question. oc is the OpenShift client that is basically kubectl + extra support for OpenShfit features. I am so used to typing it that I forgot to edit my answer to make it use kubectl instead. – Refusal