using kubectl how can i see the logs for a pod
Use:
kubectl logs
If the pod has multiple containers:
kubectl logs -c
For live streaming logs:
kubectl logs -f
For previous instance (e.g. after crash):
kubectl logs --previous
You can combine flags too:
kubectl logs -f --previous -c
can i prettify this json output with grep or something?
grep
won’t prettify JSON—it just filters lines. Use jq
instead. Pipe the output:
kubectl logs | jq
For container logs:
kubectl logs -c | jq
If the logs aren’t valid JSON per line, you can try:
kubectl logs | jq -R 'fromjson?'
That tries to parse each line as JSON, skipping invalid ones.
jq after few entries “parse error: Invalid numeric literal at line 6, column 11”
That error usually means your logs include lines that aren’t valid JSON—possibly malformed entries, plain text, or partial lines.
Here’s how to handle that robustly:
kubectl logs | jq -R 'fromjson?'
This treats each line as a raw string (-R
), attempts to parse as JSON (fromjson?
), and skips lines that fail.
If you know valid entries start with {
, for example:
kubectl logs | grep '^{.*}' | jq -R 'fromjson?'
To find and inspect the bad entries:
kubectl logs | jq -R 'try fromjson catch .'
This shows raw lines on failure instead of skipping them—useful for debugging.
Want to isolate only the malformed lines?:
kubectl logs | jq -R 'select(try fromjson | not)'
Let me know if you’re working with multi-line JSON or structured log formats (e.g., GCP-style).
i am getting a bunch of json formatted logs with the following command kubectl logs -f deployment-backend-847d585f47-sc55p | jq -R ‘fromjson? | select(.user_agent | test(“SURAJ”))’
each incoming json object has a “time” key with the value being formatted thusly “2025-04-14T19:28:06.643848075Z”
using my jq command, is it possible to humanize this time field and change it to a more readable format?
Yes. jq
doesn’t natively parse RFC3339 nanosecond timestamps, but you can trim and parse it to a readable format with a little string work.
kubectl logs -f deployment-backend-847d585f47-sc55p \
| jq -R 'fromjson?
| select(.user_agent | test("SURAJ"))
| .time = (.time | sub("\\..*"; "") | fromdateiso8601 | strftime("%Y-%m-%d %H:%M:%S"))'
sub("\\..*"; "")
: removes the fractional seconds (.643848075
) to get a standard RFC3339 timestamp.fromdateiso8601
: parses it into a Unix timestamp.strftime(...)
: formats it human-readably.You can of course change the format string to anything you prefer, e.g.:
"%Y-%m-%d %H:%M:%S"
"%b %d %H:%M"
"%I:%M:%S %p"
Let me know if you want to append the human-readable time instead of replacing the original.
this command does not work, i can see it running but i see no logs no output
Thanks—likely cause: fromjson?
fails silently when .time
isn’t present or the timestamp can’t be parsed (due to the nanoseconds). Let’s isolate and validate step by step.
kubectl logs -f deployment-backend-847d585f47-sc55p | head -n 5
Ensure each line is valid JSON with a .time
field.
kubectl logs -f deployment-backend-847d585f47-sc55p \
| jq -R 'fromjson? | select(.time) | {time: .time}'
kubectl logs -f deployment-backend-847d585f47-sc55p \
| jq -R '
fromjson?
| select(.user_agent | test("SURAJ"))
| select(.time)
| .human_time = (.time | sub("\\..*"; "") | fromdateiso8601 | strftime("%Y-%m-%d %H:%M:%S"))
'
select(.time)
: skips lines without .time
.sub("\\..*"; "")
: strips nanoseconds (.643848075Z
→ 2025-04-14T19:28:06Z
)fromdateiso8601
can now parse it..human_time
instead of replacing .time
.Let me know if you want to filter time range or change the output structure.
the first two work fine, i can see each log has time but the third one gives no output
Got it. That points to the issue being in this part:
sub("\\..*"; "")
This regex removes everything from the dot onward—including the trailing Z
, which fromdateiso8601
requires.
Use this instead:
sub("\\.[0-9]+Z$"; "Z")
Full working command:
kubectl logs -f deployment-backend-847d585f47-sc55p \
| jq -R '
fromjson?
| select(.user_agent | test("SURAJ"))
| select(.time)
| .human_time = (
.time
| sub("\\.[0-9]+Z$"; "Z")
| fromdateiso8601
| strftime("%Y-%m-%d %H:%M:%S")
)
'
This trims only the nanoseconds, preserves the Z
, and parses correctly.
Let me know if you want time
replaced instead of duplicated as human_time
.
make this last command an alias, add it to my zshrc call it klog-cua
Add this to your ~/.zshrc
:
alias klog-cua='kubectl logs -f deployment-backend-847d585f47-sc55p | jq -R '\''fromjson? | select(.user_agent | test("SURAJ")) | select(.time) | .human_time = (.time | sub("\\.[0-9]+Z$"; "Z") | fromdateiso8601 | strftime("%Y-%m-%d %H:%M:%S"))'\'''
Then run:
source ~/.zshrc
Now you can just run:
klog-cua
Let me know if you want to parameterize the pod name or the user-agent match string.
any way to list all available aliases in zsh?
Yes—just run:
alias
That lists all currently defined aliases in your Zsh session.
To find a specific one (e.g., klog-cua
):
alias | grep klog-cua
To list aliases defined in your zshrc (not inherited), you can also grep your config:
grep '^alias' ~/.zshrc
Let me know if you want a function instead—more flexible than an alias if you’re planning to pass args.