What kubectl command can I use to get events sorted by specific fields and print only specific details of events?

I need to print only specific fields of Kubernetes Events, sorted by a specific field.

This is to help me gather telemetry and analytics about my namespace

How could I do that?

5 Answers

kubectl get events --sort-by='.lastTimestamp'

Following command does it.

It prints the events sorted by timestamp of creation.

It also users go-template to filter out specific fields of the kubernetes-event object.

kubectl get events --sort-by='.metadata.creationTimestamp' -o 'go-template={{range .items}}{{.involvedObject.name}}{{"\t"}}{{.involvedObject.kind}}{{"\t"}}{{.message}}{{"\t"}}{{.reason}}{{"\t"}}{{.type}}{{"\t"}}{{.firstTimestamp}}{{"\n"}}{{end}}' 

I am using the following command to sort it after timestamp

kubectl get event --all-namespaces --sort-by='.metadata.managedFields[0].time' 

For filtering out the information you can of course combine it with the go-template described by @suryakrupa or with jq described by @Chris Stryczynski

If you don't mind seeing the output as JSON:

kubectl get event -o json | jq '.items |= sort_by(.lastTimestamp)' 

This requires jq.

Here's the Bash function I use:

function kubectl-events { { echo $'TIME\tNAMESPACE\tTYPE\tREASON\tOBJECT\tSOURCE\tMESSAGE'; kubectl get events -o json "$@" \ | jq -r '.items | map(. + {t: (.eventTime//.lastTimestamp)}) | sort_by(.t)[] | [.t, .metadata.namespace, .type, .reason, .involvedObject.kind + "/" + .involvedObject.name, .source.component + "," + (."-"), .message] | @tsv'; } \ | column -s $'\t' -t \ | less -S } 

You can use it like: kubectl-events -A, kubectl-events -n foo, etc.