Logging Module

Logging Module provides a logging stack for SIGHUP Distribution (SD).

If you are new to SD please refer to the official documentation on how to get started with SD.

Overview

Logging Module uses a collection of open source tools to provide a resilient and robust logging stack for the cluster.

The central piece of the stack is the open source search engine OpenSearch, combined with its analytics and visualization platform OpenSearch Dashboards. Logs are collected by a node-level data collection and enrichment agent, Fluent Bit, and pushed to OpenSearch through Fluentd. The Fluent Bit and Fluentd stack is managed by the Logging Operator. Loki is also available as an alternative log storage backend to OpenSearch.

All the components are deployed in the logging namespace in the cluster.

High-level diagram of the stack:

Packages

The following packages are included in the Logging module:

Package	Version	Description
opensearch-single	v3.7.0	Single node opensearch deployment. Not intended for production use.
opensearch-triple	v3.7.0	Three node high-availability opensearch deployment
opensearch-dashboards	v3.7.0	Analytics and visualization platform for Opensearch
logging-operator	v6.5.1	Banzai logging operator, manages fluentbit/fluentd and their configurations
logging-operated	-	fluentd and fluentbit deployment using logging operator
configs	-	Logging pipeline configs to gather various types of logs and send them to OpenSearch
loki-configs	-	Logging pipeline configs to gather various types of logs and send them to Loki
loki-distributed	v3.7.2	Distributed Loki deployment
minio-ha	RELEASE.2026-05-20T23-44-52Z	Three nodes HA MinIO deployment

Click on each package to see its full documentation.

Compatibility

Kubernetes Version	Compatibility	Notes
1.29.x	✅	No known issues
1.30.x	✅	No known issues
1.31.x	✅	No known issues
1.32.x	✅	No known issues
1.33.x	✅	No known issues
1.34.x	✅	No known issues
1.35.x	✅	No known issues

Check the compatibility matrix for additional information about previous releases of the modules.

Usage

Logging Module is part of SIGHUP Distribution (SD) and is deployed automatically by furyctl when you create or update a cluster. You don't need to download, vendor or install its packages manually.

Configuration

You configure the module under spec.distribution.modules.logging in your furyctl.yaml. The type field selects the logging stack to deploy: opensearch, loki, customOutputs, or none to disable the module. When using OpenSearch, opensearch.type selects a single or triple node deployment. The other fields are optional and fall back to sensible defaults.

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      logging:
        type: opensearch
        opensearch:
          type: single
          storageSize: 150Gi

To use Loki as the log storage backend instead, set type: loki and choose the Loki storage backend with loki.backend (minio for an in-cluster MinIO deployment, or externalEndpoint for an external S3-compatible object storage):

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      logging:
        type: loki
        loki:
          backend: minio

See the configuration reference for your cluster kind for the full list of available options: EKSCluster, KFDDistribution or OnPremises.

To install SD from scratch, follow the Getting started guide.

Contributing

Before contributing, please read first the Contributing Guidelines.

Reporting Issues

In case you experience any problems with the module, please open a new issue.

License

This module is open-source, and it's released under the following LICENSE