How to forward pod status containerStatuses lastState?

[devopsmash]

Question

I need to capture containerStatuses.lastState from pod statuses to monitor failure exit codes like 1 or 137.

What is the correct Vector configuration for this?

Vector Config

No response

Vector Logs

No response

[agrovr]

The kubernetes_logs source cannot expose arbitrary fields from the Pod .status object. Its documented enrichment schema includes selected Pod/container identity and metadata (labels, annotations, IPs, owner, etc.), but not status.containerStatuses.

For exit codes, the usual source is kube-state-metrics, which already converts this part of the Pod API into Prometheus metrics:

• kube_pod_container_status_last_terminated_exitcode
• kube_pod_container_status_last_terminated_reason
• kube_pod_container_status_last_terminated_timestamp

Vector can scrape that endpoint and forward the resulting metric events to your existing metrics sink:

sources:
  kube_state_metrics:
    type: prometheus_scrape
    endpoints:
      - http://kube-state-metrics.kube-system.svc.cluster.local:8080/metrics
    scrape_interval_secs: 15

sinks:
  your_metrics_sink:
    inputs:
      - kube_state_metrics
    # your existing metrics sink configuration

Then query or alert on the exit-code metric, for example:

kube_pod_container_status_last_terminated_exitcode != 0

or specifically:

kube_pod_container_status_last_terminated_exitcode == 137

This is preferable to attaching lastState to every log line: lastState is a current Pod-status snapshot, while a time-series backend preserves when the value appeared and lets you alert by namespace, pod, and container.

References:

• Vector kubernetes_logs output fields: https://vector.dev/docs/reference/configuration/sources/kubernetes_logs/
• Vector prometheus_scrape source: https://vector.dev/docs/reference/configuration/sources/prometheus_scrape/
• kube-state-metrics Pod metrics: https://github.com/kubernetes/kube-state-metrics/blob/main/docs/metrics/workload/pod-metrics.md

The kube-state-metrics last_terminated metrics are currently marked experimental, so confirm that your installed kube-state-metrics version exposes them. This forwards metric events rather than the raw nested lastState JSON object.