How To List Events With kubectl

In Kubernetes, events provide detailed information for the activities related to Kubernetes objects such as pods, nodes or containers, and are used for observability and troubleshooting issues like when your pod isn’t running or your container crashes. 

The short answer

To display the detailed list of events executed in the Kubernetes cluster, you can use the command as follows:

 $ kubectl get events

Upon execution, the above command will output verbose details about the events like last seen, type, reason, object, and message. 

Where:

• LAST SEEN specifies the time elapsed since the event was last recorded. 
• TYPE specifies the type of event like [.inline-code]Normal[.inline-code], [.inline-code]Warning[.inline-code] or [.inline-code]Error[.inline-code]. 
• REASON is a brief text describing the event (eg: [.inline-code]Pulling[.inline-code], [.inline-code]Scheduled[.inline-code], [.inline-code]Starting[.inline-code]). 
• OBJECT specifies the object related with the event, such as a pod or node. 
• MESSAGE specifies the detailed description of the event.

[#easily-recall-with-ai] Easily retrieve this syntax using Warp AI feature [#easily-recall-with-ai]

If you’re using Warp as your terminal, you can easily retrieve this syntax using the Warp AI feature:Entering [.inline-code]kubectl get events[.inline-code] in the AI question input will prompt a human-readable step by step guide including code snippets.

Listing events in a namespaceEntering [.inline-code]kubectl get events[.inline-code] in the AI question input will prompt a human-readable step by step guide including code snippets.Entering [.inline-code]kubectl get events[.inline-code] in the AI question input will prompt a human-readable step by step guide including code snippets.

Entering [.inline-code]kubectl get events[.inline-code] in the AI question input will prompt a human-readable step by step guide including code snippets.

[#list-events-in-a-namespace] Listing events in a namespace [#list-events-in-a-namespace]

In Kubernetes, namespaces provide a logical way to separate resources within an application. 

To list all the events in a specified namespace, you can use the [.inline-code]kubectl get events[.inline-code] command with the [.inline-code]-n[.inline-code] flag (short for [.inline-code]--namespace[.inline-code]) as follows: 

 $ kubectl get events -n <namespace>

For example:

 $ kubectl get events -n myNamespace

Upon execution, the above command will list all the events which occurred in the Namespace named [.inline-code]myNamespace[.inline-code].

Listing events in all namespaces

By default, the [.inline-code]kubectl get events[.inline-code] lists events within the current namespace. 

To list events across all namespaces, you can use the [.inline-code]kubectl get events[.inline-code] command with the [.inline-code]--all-namespaces[.inline-code] flag:

 $ kubectl get events --all-namespaces

If you want to learn more about namespaces, you can read our article on how to create a namespace in Kubernetes with kubectl.

[#list-events-with-additional-information] Listing all events with additional information [#list-events-with-additional-information]

To display additional information about the events, you can use the [.inline-code]-o wide[.inline-code] flag (short for [.inline-code]--output wide[.inline-code]) as follows:

 $ kubectl get events -o wide

Where:

• SUBOBJECT is a specific part of the Kubernetes object associated with the event like container, volume, and so on.
• SOURCE is the source which triggered the event.
• FIRST SEEN is the timestamp when the event was first observed. 
• COUNT is the number of occurrences of the event since it was first seen.
• NAME is the name of the Kubernetes object like pod, node, and so on. 

[#watch-events-in-real-time] Watching the events in the Kubernetes cluster [#watch-events-in-real-time]

To watch the events in the Kubernetes cluster in real-time, you can use the [.inline-code]--watch[.inline-code] flag with the [.inline-code]kubectl get events[.inline-code] command as follows:

 $ kubectl get events --watch

Upon execution, the above command will start real-time tracking of events in your Kubernetes cluster, providing continuous visibility to the changes in objects like Pods, Nodes and so on.

[#list-events-in-yaml-or-json] Listing events in the YAML and JSON formats [#list-events-in-yaml-or-json]

By default, the output format of the [.inline-code]kubectl get events[.inline-code] command is a table. However, you can specify other formats, such as YAML or JSON using the [.inline-code]-o[.inline-code] flag (short for [.inline-code]--output[.inline-code]) as follows:

 $ kubectl get events -o <format>

Where:

• [.inline-code]format[.inline-code] is one of [.inline-code]yaml[.inline-code] or [.inline-code]json[.inline-code]. 

For example:

 $ kubectl get events -o json

Upon execution, the above command will display comprehensive details for events (like source of event, object, timing, etc.) in the specified JSON format. 

[#filter-events-by-field-selector] Filtering events using a field selector [#filter-events-by-field-selector]

To filter the list of events based on a specific field, you can use the [.inline-code]kubectl get events[.inline-code] command with the [.inline-code]--field-selector[.inline-code] flag as follows:

 $ kubectl get events --field-selector <field_name><operator><field_value>

Where:

• [.inline-code]field_name[.inline-code] is a JSONPath expression used for selecting a specific field.
• [.inline-code]operator[.inline-code] is a comparison operation which can be one of [.inline-code]==[.inline-code] or [.inline-code]!=[.inline-code].
• [.inline-code]field_value[.inline-code] is the value for the specified field.

For example, this command will filter and display the list of all events that are of type [.inline-code]Warning[.inline-code] or [.inline-code]Error[.inline-code]:

 $ kubectl get events --field-selector type=Warning,type=Error

And this command will filter and display events excluding the events of Kubernetes Nodes:

 $ kubectl get events --field-selector involvedObject.kind!=Node

You can learn more about the JSONPath expressions by visiting the official Kubernetes documentation page.

Filtering events by Pod Name

To filter events by a pod name, you can use the aforementioned [.inline-code]--field-selector[.inline-code] flag as follows:

 $ kubectl get events --field-selector involvedObject.kind=pod,involvedObject.name=myPod

Upon execution, the above command will list all the events for the Kubernetes object [.inline-code]Pod[.inline-code] named [.inline-code]myPod[.inline-code]. 

Note that, listing events will help you identify any failures in your running Pod. For example, if a container within a Pod cannot start, the [.inline-code]Reason[.inline-code]  will be set to [.inline-code]ContainerCannotRun[.inline-code] and accompanied by the additional context in the [.inline-code]Message[.inline-code] property. 

Additionally, you can read our article on how to describe a Kubernetes Pod with kubectl to retrieve details about the pod and its events.

[#sort-the-list-of-events] Sorting the output of the [.inline-code]kubectl get events[.inline-code] command [#sort-the-list-of-events]

To sort the output of the [.inline-code]kubectl get events[.inline-code] command based on a specific field, you can use the [.inline-code]kubectl get events[.inline-code] command with the [.inline-code]--sort-by[.inline-code] flag as follows:

 $ kubectl get events --sort-by=<expression>

Where:

• [.inline-code]expression[.inline-code] is a JSONPath expression. 

For example, this command will display the list of all events sorted by their creation timestamp in ascending order:

 $ kubectl get events --sort-by=.metadata.creationTimestamp

And this command will display the list of events sorted by the last seen timestamp:

 $ kubectl get events --sort-by=.lastTimestamp

Note that while it’s not currently possible to list events within a specific time range or duration, you can sort the event list by creation or last seen timestamp using the above commands and identify events in chronological order.

[#customize-the-event-list-output] Customizing the output of the [.inline-code]kubectl get events[.inline-code] command [#customize-the-event-list-output]

To customize the output columns of the [.inline-code]kubectl get events[.inline-code] command, you can use the [.inline-code]kubectl get events[.inline-code] command with the [.inline-code]-o custom-columns[.inline-code] flag:

 $ kubectl get events -o custom-columns=<custom_column_name>:<expression>

Where:[.inline-code]custom_column_name[.inline-code] is the name you want to assign to a column. [.inline-code]expression[.inline-code] is a JSONPath expression.

For example:

 $ kubectl get events -o custom-columns=NAME:involvedObject.name,CREATIONTIME:.metadata.creationTimestamp

Upon execution, the above command will output two columns, [.inline-code]NAME[.inline-code] populated with the value of [.inline-code]involvedObject.name[.inline-code] and [.inline-code]CREATIONTIME[.inline-code] populated with the values of [.inline-code].metadata.creationTimestamp[.inline-code].

And if specifying [.inline-code]custom-columns[.inline-code] becomes lengthy or if you plan to reuse the same column configurations frequently, you can opt for a template file as follows:

 $ kubectl get events -o custom-columns-file=./myTemplate.txt

Where the [.inline-code]myTemplate.txt[.inline-code] file contains:

 NAME                         CREATIONTIME
involvedObject.name .metadata.creationTimestamp