GKE: How to send Stackdriver logs to projects/<projectId>/logs/syslog

General Discussions microk8s
1

Hi Team,

Please help
How can I send k8s_container logs to projects//logs/syslog through Stackdriver.

Scenario:

I have applications running in GKE container which logs the activities (Audit Logs) through Stackdriver into GCP. These logs can be seen under resource.type=k8s_container or projects//logs/stdout

I want to forward these logs to SIEM through sink, but the SIEM does not support resource.type=k8s_container as filter.
How can I send these logs to “projects//logs/syslog” so that SIEM may read the logs (Pull through Pub/Sub)

Supported Filters:

  1. cloudaudit.googleapis.com/activity
  2. compute.googleapis.com/vpc_flows
  3. syslog
  4. apache
  5. nginx

Regards

Naveen