How to view Kubernetes pod logs

Kubernetes pod logs show what a container writes to standard output and standard error while it runs on a node. They are often the first place to check application messages, startup output, and crash details after the pod object exists.

kubectl logs reads the pod log subresource through the Kubernetes API, and the kubelet returns the container log file from the node. A single-container pod can be read by pod name alone, while a multi-container pod needs --container so the output comes from the intended process.

Log availability depends on node retention and pod lifecycle. --previous works only when Kubernetes still has a previous terminated container instance, and rotated, deleted, or evicted pod logs may no longer be available through kubectl logs.

1. List pods in the namespace that owns the workload.

   $ kubectl get pods --namespace app-prod
   NAME                READY   STATUS    RESTARTS      AGE
   restarting-worker   1/1     Running   1 (15s ago)   32s
   web                 2/2     Running   0             32s

   Use the application namespace instead of app-prod. The READY column helps identify pods with more than one running container.

2. Read logs from the application container.

   $ kubectl logs --namespace app-prod pod/web --container app
   app request 1 accepted
   app request 2 accepted

   For a pod with one regular container, --container is optional. Keep it when the pod has sidecars or more than one application container.

3. Read logs from another container in the same pod.

   $ kubectl logs --namespace app-prod pod/web --container sidecar
   sidecar heartbeat 1

   Container names come from the pod spec, not the image name. Use kubectl get pod <pod> -o jsonpath='{.spec.containers[*].name}' when the names are not obvious.

4. Limit the output to log lines written during a recent time window.

   $ kubectl logs --namespace app-prod pod/web --container app --since=1m
   app request 1 accepted
   app request 2 accepted

   --since accepts relative durations such as 10m or 2h. Use --tail when a noisy pod needs only the newest lines.

5. Stream new log lines while the pod continues running.

   $ kubectl logs --namespace app-prod pod/web --container app --follow --tail=1
   app request 2 accepted
   app request 3 accepted
   ^C

   Press Ctrl-C after enough lines are visible. --tail keeps the initial scrollback short before the live stream starts.

6. Read logs from the previous container instance after a restart.

   $ kubectl logs --namespace app-prod pod/restarting-worker --container app --previous
   worker attempt 1 started
   worker failed before opening queue

   If --previous returns no logs, inspect pod events and the owning workload before assuming the application wrote nothing.
   Related: How to check Kubernetes events