{"id":"c9be717a-bcfa-43c2-900a-6fbf540b4387","shortId":"HtVGwx","kind":"skill","title":"whizard-logging","tagline":"Use when working with WizTelemetry Logging extension for KubeSphere, including installation, configuration, and log query API","description":"# WizTelemetry Logging\n\n## Overview\n\nWizTelemetry Logging is an extension component in the KubeSphere Observability Platform for log collection, processing, and storage.\n\n## When to Use\n\n- Installing or configuring the WizTelemetry Logging extension\n- Understanding log collection architecture (container logs + disk log collection)\n- Using the log query API to query logs\n\n## Components\n\n| Component | Description | Default Enabled |\n|-----------|-------------|-----------------|\n| vector-logging | Container log collection (collects stdout/stderr from Docker/Containerd) | true |\n| logsidecar-injector | Disk log collection (collects logs from files inside containers) | false |\n\n## Dependencies\n\n- **WizTelemetry Platform Service** (whizard-telemetry): Required\n- **WizTelemetry Data Pipeline** (vector): Required\n- **OpenSearch** (opensearch): Required\n\n## Installation\n\n### Prerequisites\n\n**REQUIRED: Complete all steps in order before generating InstallPlan.**\n\n#### Step 1: Get Available Clusters and Confirm Target\n\n**⚠️ CRITICAL: DO NOT proceed until target clusters are determined.**\n\n**Step 1.1: Get available clusters**\n\n```bash\nkubectl get clusters -o jsonpath='{.items[*].metadata.name}'\n```\n\n**Step 1.2: Determine target clusters**\n\n- If user **explicitly specified** target clusters in the request → Use those clusters directly, proceed to Step 2\n- If user **did NOT specify** target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2\n\n**Ask user (if not specified):**\n```\nAvailable clusters: host, dev\nWhich clusters do you want to deploy WizTelemetry Logging to?\n```\n\n#### Step 2: Get Latest Version (if not provided by user)\n\n**MUST do this to get the latest version:**\n\n```bash\nkubectl get extensionversions -l kubesphere.io/extension-ref=whizard-logging -o jsonpath='{range .items[*]}{.spec.version}{\"\\n\"}{end}' | sort -V | tail -1\n```\n\nThis outputs the latest version (e.g., `1.4.0`). Note this down - you'll use it in the InstallPlan.\n\n### Install WizTelemetry Logging\n\n**⚠️ IMPORTANT: Complete prerequisite steps BEFORE this step.**\n\nBased on your selections:\n- **Target clusters**: User-confirmed cluster names\n\n**⚠️ CRITICAL: InstallPlan `metadata.name` MUST be `whizard-logging`. DO NOT use any other name.**\n\n**⚠️ CRITICAL: `config` field is YAML format. You MUST:**\n- Use the config structure exactly as shown in the template\n- **DO NOT** add configuration fields that are not shown in the template\n- **DO NOT** modify the structure or hierarchy\n\n**⚠️ CRITICAL: All placeholders MUST be replaced with actual values. DO NOT leave them as placeholders.**\n\n#### Template\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-logging\nspec:\n  extension:\n    name: whizard-logging\n    version: <VERSION>  # From Step 2\n  enabled: true\n  upgradeStrategy: Manual\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n**Replace placeholders:**\n- `<VERSION>`: From Step 3 (e.g., `1.4.0`)\n- `<TARGET_CLUSTERS>`: User-confirmed cluster names\n\n**Note:** OpenSearch sink configuration (endpoints, auth) is provided by the **vector** extension. Make sure vector is installed and configured with OpenSearch before installing logging.\n\n#### Enable Disk Log Collection\n\nTo enable disk log collection, add `logsidecar-injector` to the config:\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-logging\nspec:\n  extension:\n    name: whizard-logging\n    version: <VERSION>  # From Step 3\n  enabled: true\n  upgradeStrategy: Manual\n  config: |\n    logsidecar-injector:\n      enabled: true\n    vector-logging:\n      filter:\n        extraLabelSelector: \"app.kubernetes.io/name!=kube-events-exporter\"\n      calico:\n        enabled: true\n      systemd:\n        docker:\n          enabled: true\n        kubelet:\n          enabled: true\n      sinks:\n        opensearch:\n          enabled: true\n          index:\n            prefix: \"{{ .cluster }}-logs\"\n            timestring: \"%Y.%m.%d\"\n  clusterScheduling:\n    placement:\n      clusters:\n        - <TARGET_CLUSTERS>\n```\n\n## Configuration Parameters\n\n### Logsidecar Injector Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `logsidecar-injector.enabled` | bool | false | Enable disk log collection |\n| `logsidecar-injector.sidecar.sidecarType` | string | vector | Sidecar type |\n| `logsidecar-injector.resources.limits.cpu` | string | 100m | CPU limit |\n| `logsidecar-injector.resources.limits.memory` | string | 100Mi | Memory limit |\n| `logsidecar-injector.resources.requests.cpu` | string | 10m | CPU request |\n| `logsidecar-injector.resources.requests.memory` | string | 10Mi | Memory request |\n\n### Vector Logging Parameters\n\n#### Filter Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `vector-logging.filter.extraLabelSelector` | string | \"app.kubernetes.io/name!=kube-events-exporter\" | Extra label selector |\n| `vector-logging.filter.extraNamespaceLabelSelector` | string | \"\" | Extra namespace label selector |\n| `vector-logging.filter.includeNamespaces` | list | [] | List of namespaces to collect |\n| `vector-logging.filter.excludeNamespaces` | list | [] | List of namespaces to exclude |\n\n#### Calico Log Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `vector-logging.calico.enabled` | bool | true | Enable Calico log collection |\n| `vector-logging.calico.logPath` | list | [\"/var/log/calico/cni/cni*.log\"] | Calico log paths |\n\n#### Systemd Log Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `vector-logging.systemd.docker.enabled` | bool | true | Enable Docker systemd log collection |\n| `vector-logging.systemd.kubelet.enabled` | bool | true | Enable Kubelet systemd log collection |\n| `vector-logging.systemd.directory` | string | /var/log/journal | Systemd journal directory |\n\n#### OpenSearch Sink Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `vector-logging.sinks.opensearch.enabled` | bool | true | Enable OpenSearch sink |\n| `vector-logging.sinks.opensearch.index.prefix` | string | \"{{ .cluster }}-logs\" | Index prefix |\n| `vector-logging.sinks.opensearch.index.timestring` | string | \"%Y.%m.%d\" | Index time format |\n\n#### ISM Policy Parameters\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `vector-logging.ism_policy.enable` | bool | false | Enable Index State Management policy |\n| `vector-logging.ism_policy.min_index_age` | string | \"7d\" | Minimum index retention period |\n\n## Log Query API\n\n### Query Logs\n\n```bash\ncurl -X GET \"http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/logs?operation=query&log_query=error&size=10&cluster=host&sort=desc\" \\\n  -H \"X-Remote-User: admin\"\n```\n\n**Query Parameters:**\n\n| Parameter | Type | Default | Description |\n|-----------|------|---------|-------------|\n| `operation` | string | query | Operation type: query/statistics/histogram/export |\n| `namespaces` | string | | Comma-separated list of namespaces |\n| `namespace_query` | string | | Fuzzy match namespace names |\n| `workloads` | string | | Comma-separated list of workloads |\n| `workload_query` | string | | Fuzzy match workload names |\n| `pods` | string | | Comma-separated list of pods |\n| `pod_query` | string | | Fuzzy match pod names |\n| `containers` | string | | Comma-separated list of containers |\n| `container_query` | string | | Fuzzy match container names |\n| `log_query` | string | | Log content keywords (case-insensitive) |\n| `interval` | string | 15m | Time interval for histogram (e.g., 15m, 1h, 1d) |\n| `start_time` | string | | Start time (seconds since epoch) |\n| `end_time` | string | | End time (seconds since epoch) |\n| `sort` | string | desc | Sort order: asc/desc |\n| `from` | int | 0 | Offset |\n| `size` | int | 10 | Number of results |\n| `cluster` | string | host | Cluster name |\n| `exportLineLimit` | int | | Max lines for export |\n\n## Extension Operations\n\n### Check Extension Status\n\n```bash\nkubectl get installplan whizard-logging\nkubectl get extensionversions -l kubesphere.io/extension-ref=whizard-logging\n```\n\n### Uninstall Extension\n\n**Uninstall from all clusters:**\n\n```bash\nkubectl delete installplan whizard-logging\n```\n\n**Uninstall from specific cluster:**\n\nTo remove WizTelemetry Logging from a specific cluster, update the InstallPlan by removing that cluster from `clusterScheduling.placement.clusters`:\n\n```yaml\napiVersion: kubesphere.io/v1alpha1\nkind: InstallPlan\nmetadata:\n  name: whizard-logging\nspec:\n  extension:\n    name: whizard-logging\n    version: <VERSION>\n  enabled: true\n  upgradeStrategy: Manual\n  clusterScheduling:\n    placement:\n      clusters:\n        - <REMAINING_CLUSTERS>  # Remove the cluster you want to uninstall from\n```","tags":["whizard","logging","kubesphere","agent-skills","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","llm","multi-cluster"],"capabilities":["skill","source-kubesphere","skill-whizard-logging","topic-agent-skills","topic-cloud-native","topic-cncf","topic-devops","topic-ebpf","topic-hacktoberfest","topic-kubernetes","topic-kubesphere","topic-llm","topic-multi-cluster","topic-multi-tenancy","topic-observability"],"categories":["kubesphere"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/kubesphere/kubesphere/whizard-logging","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add kubesphere/kubesphere","source_repo":"https://github.com/kubesphere/kubesphere","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 16920 github stars · SKILL.md body (8,981 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-03T00:52:31.221Z","embedding":null,"createdAt":"2026-04-18T21:53:21.589Z","updatedAt":"2026-05-03T00:52:31.221Z","lastSeenAt":"2026-05-03T00:52:31.221Z","tsv":"'-1':251 '/extension-ref=whizard-logging':240,853 '/kapis/logging.kubesphere.io/v1alpha2/logs?operation=query&log_query=error&size=10&cluster=host&sort=desc':693 '/name!=kube-events-exporter':477,557 '/v1alpha1':361,442,892 '/var/log/calico/cni/cni':597 '/var/log/journal':627 '0':816 '1':124 '1.1':141 '1.2':154 '1.4.0':258,392 '10':820 '100m':526 '100mi':531 '10m':536 '10mi':541 '15m':783,789 '1d':791 '1h':790 '2':174,195,216,378 '3':390,459 '7d':677 'actual':348 'add':324,431 'admin':699 'age':675 'api':19,63,684 'apivers':358,439,889 'app.kubernetes.io':476,556 'app.kubernetes.io/name!=kube-events-exporter':475,555 'architectur':53 'asc/desc':813 'ask':182,196 'auth':403 'avail':126,143,201 'base':279 'bash':145,233,687,840,860 'bool':513,589,610,618,639,666 'calico':478,581,592,599 'case':779 'case-insensit':778 'check':837 'cluster':127,137,144,148,157,163,169,181,187,202,206,284,288,385,396,494,502,646,824,827,859,870,878,885,913,916 'clusterschedul':383,500,911 'clusterscheduling.placement.clusters':887 'collect':36,52,58,77,78,88,89,425,430,518,573,594,616,624 'comma':715,730,745,760 'comma-separ':714,729,744,759 'complet':115,273 'compon':28,67,68 'config':305,314,437,464 'configur':15,45,325,401,416,503 'confirm':129,185,287,395 'contain':54,75,94,757,764,765,770 'content':776 'cpu':527,537 'critic':131,290,304,341 'curl':688 'd':499,654 'data':105 'default':70,510,551,586,607,636,663,704 'delet':862 'depend':96 'deploy':189,211 'desc':810 'descript':69,511,552,587,608,637,664,705 'determin':139,155 'dev':204 'direct':170 'directori':630 'disk':56,86,423,428,516 'docker':482,613 'docker/containerd':81 'e.g':257,391,788 'enabl':71,379,422,427,460,468,479,483,486,490,515,591,612,620,641,668,907 'end':247,800,803 'endpoint':402 'epoch':799,807 'exact':316 'exclud':580 'explicit':160 'export':834 'exportlinelimit':829 'extens':10,27,49,370,409,451,835,838,855,901 'extensionvers':236,849 'extra':558,563 'extralabelselector':474 'fals':95,514,667 'field':306,326 'file':92 'filter':473,547 'format':309,657 'fuzzi':723,738,753,768 'generat':121 'get':125,142,147,217,229,235,690,842,848 'h':694 'hierarchi':340 'histogram':787 'host':203,826 'import':272 'includ':13 'index':492,648,655,669,674,679 'injector':85,434,467,506 'insensit':780 'insid':93 'instal':14,43,112,269,414,420 'installplan':122,268,291,363,444,843,863,881,894 'int':815,819,830 'interv':781,785 'ism':658 'item':151,244 'journal':629 'jsonpath':150,242 'keyword':777 'kind':362,443,893 'kubectl':146,234,841,847,861 'kubelet':485,621 'kubespher':12,31 'kubesphere.io':239,360,441,852,891 'kubesphere.io/extension-ref=whizard-logging':238,851 'kubesphere.io/v1alpha1':359,440,890 'l':237,850 'label':559,565 'latest':218,231,255 'leav':352 'limit':528,533 'line':832 'list':568,569,575,576,596,717,732,747,762 'll':263 'log':3,9,17,21,24,35,48,51,55,57,61,66,74,76,87,90,213,271,297,368,374,421,424,429,449,455,472,495,517,545,582,593,598,600,603,615,623,647,682,686,772,775,846,866,874,899,905 'logsidecar':84,433,466,505 'logsidecar-injector':83,432,465 'logsidecar-injector.enabled':512 'logsidecar-injector.resources.limits.cpu':524 'logsidecar-injector.resources.limits.memory':529 'logsidecar-injector.resources.requests.cpu':534 'logsidecar-injector.resources.requests.memory':539 'logsidecar-injector.sidecar.sidecartype':519 'm':498,653 'make':410 'manag':671 'manual':382,463,910 'match':724,739,754,769 'max':831 'memori':532,542 'metadata':364,445,895 'metadata.name':152,292 'minimum':678 'modifi':336 'must':225,293,311,344 'n':246 'name':289,303,365,371,397,446,452,726,741,756,771,828,896,902 'namespac':564,571,578,712,719,720,725 'note':259,398 'number':821 'o':149,241 'observ':32 'offset':817 'opensearch':109,110,399,418,489,631,642 'oper':706,709,836 'order':119,812 'output':253 'overview':22 'paramet':504,507,508,546,548,549,583,584,604,605,633,634,660,661,701,702 'path':601 'period':681 'pipelin':106 'placehold':343,355,387 'placement':384,501,912 'platform':33,98 'pod':742,749,750,755 'polici':659,672 'prefix':493,649 'prerequisit':113,274 'proceed':134,171,192 'process':37 'provid':222,405 'queri':18,62,65,683,685,700,708,721,736,751,766,773 'query/statistics/histogram/export':711 'rang':243 'remot':697 'remov':872,883,914 'replac':346,386 'request':166,538,543 'requir':103,108,111,114 'result':823 'retent':680 'second':797,805 'select':282 'selector':560,566 'separ':716,731,746,761 'servic':99 'shown':318,330 'sidecar':522 'sinc':798,806 'sink':400,488,632,643 'size':818 'skill' 'skill-whizard-logging' 'sort':248,808,811 'source-kubesphere' 'spec':369,450,900 'spec.version':245 'specif':869,877 'specifi':161,179,200 'start':792,795 'state':670 'status':839 'stdout/stderr':79 'step':117,123,140,153,173,194,215,275,278,377,389,458 'storag':39 'string':520,525,530,535,540,554,562,626,645,651,676,707,713,722,728,737,743,752,758,767,774,782,794,802,809,825 'structur':315,338 'sure':411 'systemd':481,602,614,622,628 'tail':250 'target':130,136,156,162,180,283 'telemetri':102 'templat':321,333,356 'time':656,784,793,796,801,804 'timestr':496 'topic-agent-skills' 'topic-cloud-native' 'topic-cncf' 'topic-devops' 'topic-ebpf' 'topic-hacktoberfest' 'topic-kubernetes' 'topic-kubesphere' 'topic-llm' 'topic-multi-cluster' 'topic-multi-tenancy' 'topic-observability' 'true':82,380,461,469,480,484,487,491,590,611,619,640,908 'type':509,523,550,585,606,635,662,703,710 'understand':50 'uninstal':854,856,867,920 'updat':879 'upgradestrategi':381,462,909 'use':4,42,59,167,264,300,312 'user':159,176,183,197,224,286,394,698 'user-confirm':285,393 'v':249 'valu':349 'vector':73,107,408,412,471,521,544 'vector-log':72,470 'vector-logging.calico.enabled':588 'vector-logging.calico.logpath':595 'vector-logging.filter.excludenamespaces':574 'vector-logging.filter.extralabelselector':553 'vector-logging.filter.extranamespacelabelselector':561 'vector-logging.filter.includenamespaces':567 'vector-logging.ism_policy.enable':665 'vector-logging.ism_policy.min':673 'vector-logging.sinks.opensearch.enabled':638 'vector-logging.sinks.opensearch.index.prefix':644 'vector-logging.sinks.opensearch.index.timestring':650 'vector-logging.systemd.directory':625 'vector-logging.systemd.docker.enabled':609 'vector-logging.systemd.kubelet.enabled':617 'version':219,232,256,375,456,906 'want':209,918 'whizard':2,101,296,367,373,448,454,845,865,898,904 'whizard-log':1,295,366,372,447,453,844,864,897,903 'whizard-telemetri':100 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80':692 'whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/logs?operation=query&log_query=error&size=10&cluster=host&sort=desc':691 'wiztelemetri':8,20,23,47,97,104,212,270,873 'work':6 'workload':727,734,735,740 'x':689,696 'x-remote-us':695 'y':497,652 'yaml':308,357,438,888","prices":[{"id":"d82bf6ae-d8e4-4738-b1bc-541bd1c18599","listingId":"c9be717a-bcfa-43c2-900a-6fbf540b4387","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"kubesphere","category":"kubesphere","install_from":"skills.sh"},"createdAt":"2026-04-18T21:53:21.589Z"}],"sources":[{"listingId":"c9be717a-bcfa-43c2-900a-6fbf540b4387","source":"github","sourceId":"kubesphere/kubesphere/whizard-logging","sourceUrl":"https://github.com/kubesphere/kubesphere/tree/master/skills/whizard-logging","isPrimary":false,"firstSeenAt":"2026-04-18T21:53:21.589Z","lastSeenAt":"2026-05-03T00:52:31.221Z"}],"details":{"listingId":"c9be717a-bcfa-43c2-900a-6fbf540b4387","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"kubesphere","slug":"whizard-logging","github":{"repo":"kubesphere/kubesphere","stars":16920,"topics":["agent-skills","ai","cloud-native","cncf","devops","ebpf","hacktoberfest","kubernetes","kubesphere","llm","multi-cluster","multi-tenancy","observability","servicemesh","skills","skills-sh","skillsmp"],"license":"other","html_url":"https://github.com/kubesphere/kubesphere","pushed_at":"2026-04-27T06:10:27Z","description":"The container platform tailored for Kubernetes multi-cloud, datacenter, and edge management ⎈ 🖥 ☁️","skill_md_sha":"fc03317191ed8933448e62a79cc3a83db7f17237","skill_md_path":"skills/whizard-logging/SKILL.md","default_branch":"master","skill_tree_url":"https://github.com/kubesphere/kubesphere/tree/master/skills/whizard-logging"},"layout":"multi","source":"github","category":"kubesphere","frontmatter":{"name":"whizard-logging","description":"Use when working with WizTelemetry Logging extension for KubeSphere, including installation, configuration, and log query API"},"skills_sh_url":"https://skills.sh/kubesphere/kubesphere/whizard-logging"},"updatedAt":"2026-05-03T00:52:31.221Z"}}