How To List Events With kubectl

In Kubernetes, events provide detailed information for the activities related to Kubernetes objects such as pods, nodes or containers, and are used for observability and troubleshooting issues like when your pod isn’t running or your container crashes. 

The short answer

To display the detailed list of events executed in the Kubernetes cluster, you can use the command as follows:

 $ kubectl get events

Run in Warp

Upon execution, the above command will output verbose details about the events like last seen, type, reason, object, and message. 

Where:

• LAST SEEN specifies the time elapsed since the event was last recorded.
• TYPE specifies the type of event like Normal, Warning or Error.
• REASON is abrief text describing the event (eg: Pulling, Scheduled, Starting).
• OBJECT specifies the object related with the event, such as a pod or node.
• MESSAGE specifies the detailed description of the event.

Easily retrieve this syntax using Warp AI feature

If you’re using Warp as your terminal, you can easily retrieve this syntax using the Warp AI feature:Entering kubectl get events in the AI question input will prompt a human-readable step by step guide including code snippets.

Listing events in a namespaceEntering kubectl get events in the AI question input will prompt a human-readable step by step guide including code snippets.Entering kubectl get events in the AI question input will prompt a human-readable step by step guide including code snippets.

Entering kubectl get events in the AI question input will prompt a human-readable step by step guide including code snippets.

Listing events in a namespace

In Kubernetes, namespaces provide a logical way to separate resources within an application. 

To list all the events in a specified namespace, you can use the kubectl get events command with the -n flag (short for --namespace) as follows: 

 $ kubectl get events -n <namespace>

Run in Warp

For example:

 $ kubectl get events -n myNamespace

Run in Warp

Upon execution, the above command will list all the events which occurred in the Namespace named myNamespace.

Listing events in all namespaces

By default, the kubectl get events lists events within the current namespace. 

To list events across all namespaces, you can use the kubectl get events command with the --all-namespaces flag:

 $ kubectl get events --all-namespaces

Run in Warp

If you want to learn more about namespaces, you can read our article on how to create a namespace in Kubernetes with kubectl.

Listing all events with additional information

To display additional information about the events, you can use the -o wide flag (short for --output wide) as follows:

 $ kubectl get events -o wide

Run in Warp

Where:

• SUBOBJECT is a specific part of the Kubernetes object associated with the event like container, volume, and so on.
• SOURCE is the source which triggered the event.
• FIRST SEEN is the timestamp when the event was first observed.
• COUNT is the number of occurrences of the event since it was first seen.
• NAME is the name of the Kubernetes object like pod, node, and so on.

Watching the events in the Kubernetes cluster

To watch the events in the Kubernetes cluster in real-time, you can use the --watch flag with the kubectl get events command as follows:

 $ kubectl get events --watch

Run in Warp

Upon execution, the above command will start real-time tracking of events in your Kubernetes cluster, providing continuous visibility to the changes in objects like Pods, Nodes and so on.

Listing events in the YAML and JSON formats

By default, the output format of the kubectl get events command is a table. However, you can specify other formats, such as YAML or JSON using the -o flag (short for --output) as follows:

 $ kubectl get events -o <format>

Run in Warp

Where:

• format is one of yaml or json.

For example:

 $ kubectl get events -o json

Run in Warp

Upon execution, the above command will display comprehensive details for events (like source of event, object, timing, etc.) in the specified JSON format. 

Filtering events using a field selector

To filter the list of events based on a specific field, you can use the kubectl get events command with the --field-selector flag as follows:

 $ kubectl get events --field-selector <field_name><operator><field_value>

Run in Warp

Where:

• field_name is a JSONPath expression used for selecting a specific field.
• operator is a comparison operation which can be one of == or !=.
• field_value is the value for the specified field.

For example, this command will filter and display the list of all events that are of type Warning or Error:

 $ kubectl get events --field-selector type=Warning,type=Error

Run in Warp

And this command will filter and display events excluding the events of Kubernetes Nodes:

 $ kubectl get events --field-selector involvedObject.kind!=Node

Run in Warp

You can learn more about the JSONPath expressions by visiting the official Kubernetes documentation page.

Filtering events by Pod Name

To filter events by a pod name, you can use the aforementioned --field-selector flag as follows:

 $ kubectl get events --field-selector involvedObject.kind=pod,involvedObject.name=myPod

Run in Warp

Upon execution, the above command will list all the events for the Kubernetes object Pod named myPod. 

Note that, listing events will help you identify any failures in your running Pod. For example, if a container within a Pod cannot start, the Reason  will be set to ContainerCannotRun and accompanied by the additional context in the Message property. 

Additionally, you can read our article on how to describe a Kubernetes Pod with kubectl to retrieve details about the pod and its events.

Sorting the output of the kubectl get events command

To sort the output of the kubectl get events command based on a specific field, you can use the kubectl get events command with the --sort-by flag as follows:

 $ kubectl get events --sort-by=<expression>

Run in Warp

Where:

• expression is a JSONPath expression.

For example, this command will display the list of all events sorted by their creation timestamp in ascending order:

 $ kubectl get events --sort-by=.metadata.creationTimestamp

Run in Warp

And this command will display the list of events sorted by the last seen timestamp:

 $ kubectl get events --sort-by=.lastTimestamp

Run in Warp

Note that while it’s not currently possible to list events within a specific time range or duration, you can sort the event list by creation or last seen timestamp using the above commands and identify events in chronological order.

Customizing the output of the kubectl get events command

To customize the output columns of the kubectl get events command, you can use the kubectl get events command with the -o custom-columns flag:

 $ kubectl get events -o custom-columns=<custom_column_name>:<expression>

Run in Warp

Where:custom_column_name is the name you want to assign to a column. expression is a JSONPath expression.

For example:

 $ kubectl get events -o custom-columns=NAME:involvedObject.name,CREATIONTIME:.metadata.creationTimestamp

Run in Warp

Upon execution, the above command will output two columns, NAME populated with the value of involvedObject.name and CREATIONTIME populated with the values of .metadata.creationTimestamp.

And if specifying custom-columns becomes lengthy or if you plan to reuse the same column configurations frequently, you can opt for a template file as follows:

 $ kubectl get events -o custom-columns-file=./myTemplate.txt

Run in Warp

Where the myTemplate.txt file contains:

 NAME                         CREATIONTIME
involvedObject.name .metadata.creationTimestamp

Run in Warp