Adjust log throughput

This document describes default log throughput and how to increase throughput.

When system logging is enabled, a dedicated Logging agent isautomatically deployed and managed. It runson all GKE nodes in a cluster to collect logs, adds helpfulmetadata about the container, pod, and cluster, and then sends the logs toCloud Logging using a fluentbit-based agent.

The dedicated Logging agent provides at least 100 KiB persecond log throughput per node for system and workload logs. If a node isunderutilized, then depending on the type of log load (for example, text orstructured log entries, very few containers on the node or many containers),the dedicated logging agent might provide throughput as much as 500 KiB persecond or more. Additionally, in clusters with GKE controlplane version 1.23.13-gke.1000 or later, the Loggingagent allows for throughput as high as 10 MiB per second on nodes that have atleast 2 unused CPU cores. Be aware, however, that at higher throughputs, somelogs may be lost.

Identify nodes with higher log throughput

By default, GKE clusters collectsystem metrics.The system metrickubernetes.io/node/logs/input_bytes providesthe number of log bytes generated per second on a node. This metric can helpyou decide which variant of the logging agent makes sense to deploy in yourcluster or node pools.

To view the historical logging throughput for each node in your cluster, followthese steps:

  1. In the Google Cloud console, go to the Metrics explorer page:

    Go toMetrics explorer

    If you use the search bar to find this page, then select the result whose subheading isMonitoring.

  2. In theSelect a metric field, selectkubernetes.io/node/logs/input_bytes.

  3. In theGroup by field, selectproject_id,location,cluster_name, andnode_name.

  4. ClickOK

  5. Optionally, sort the list of metrics in descending order by clicking thecolumn headerValue above the list of metrics.

To understand how much logging volume is due to system components or due toworkloads running on the node, you may also group by thetype metric label.

Enable high-throughput logging

If any GKE nodes require more than 100 KiB per second logthroughput and your GKE Standard cluster is usingcontrol plane version 1.23.13-gke.1000 or later, you can configureGKE to deploy an alternative configuration of theLogging agent designed to maximize logging throughput. Thismaximum throughput Logging variant allows for throughput as highas 10 MiB per second per node. You can deploy this high-throughputLogging agent to all nodes in a cluster or to all nodes in anode pool.

This high-throughput configuration will consume additional CPU and memory.

Warning: Changing the logging agent on an existing node pool recreates allnodes. If you change the logging agent for an existing cluster, the existingnode pools are unaffected and the change only applies to new node pools added tothe cluster.

gcloud CLI

To enable high-throughput logging on all nodes in a new cluster:

gcloudcontainerclusterscreateCLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=MAX_THROUGHPUT\--machine-type=MACHINE_TYPE

Replace the following:

All newly created node pools in this cluster, including the default nodepool, deploy the high-throughput Logging agent.

To confirm if high-throughput logging is already set for an existing cluster, use thegcloud container cluster describecommand:

gcloudcontainerclustersdescribeCLUSTER_NAME\--location=COMPUTE_LOCATION\--format="value(nodePoolDefaults[].loggingConfig.variantConfig.variant)"

Replace the following:

Note: ADEFAULT output indicates the value remains unset, whereas aMAX_THROUGHPUT output signifies that it has been configured.

To configure high-throughput logging for an existing cluster:use thegcloud container clusters updatecommand:

gcloudcontainerclustersupdateCLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=MAX_THROUGHPUT

Replace the following:

To create a new node pool that uses the high-throughputLogging agent, use thegcloud container node-pools createcommand:

gcloudcontainernode-poolscreateNODEPOOL_NAME\--cluster=CLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=MAX_THROUGHPUT

Replace the following:

  • NODEPOOL_NAME: the name of the new node pool.
  • CLUSTER_NAME: the name of the cluster.
  • COMPUTE_LOCATION: theCompute Engine locationfor the new cluster.

To confirm if high-throughput logging is already set for an existing node pool use thegcloud container node-pools describecommand:

gcloudcontainernode-poolsdescribeNODEPOOL_NAME\--cluster=CLUSTER_NAME\--location=COMPUTE_LOCATION\--format="value(config.loggingConfig.variantConfig.variant)"

Replace the following:

  • NODEPOOL_NAME: the name of the node pool.
  • CLUSTER_NAME: the name of the cluster.
  • COMPUTE_LOCATION: theCompute Engine location.
Note: AnEMPTY orDEFAULT output indicates the value remains unset, whereas aMAX_THROUGHPUT output signifies that it has been configured.

To update an existing node pool, use thegcloud container node-pools updatecommand.

gcloudcontainernode-poolsupdateNODEPOOL_NAME\--cluster=CLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=MAX_THROUGHPUT

Replace the following:

  • NODEPOOL_NAME: the name of the node pool.
  • CLUSTER_NAME: the name of the cluster.
  • COMPUTE_LOCATION: theCompute Engine location.

Terraform

The following code blocks specify how to declare node pools with or withouthigh-throughput logging.

To manage the node pools explicitly, you must specify your cluster without adefault node pool.

resource"google_container_cluster""with_example_logging_variants"{provider=googlename="CLUSTER_NAME"location="COMPUTE_LOCATION"initial_node_count=1remove_default_node_pool=true# We want to manage our node pools separately.}

To specify a node pool that uses the high-throughput agent, use thenode_configfield to specify the Logging agent variant asMAX_THROUGHPUTand an appropriate machine type:

resource"google_container_node_pool""with_example_logging_variant"{provider=googlename="example-node-pool-with-htl"cluster=google_container_cluster.with_example_logging_variants.namelocation="COMPUTE_LOCATION"node_config{logging_variant="MAX_THROUGHPUT"# Use a machine type with enough CPU to accommodate the high-throughput agent, such as e2-standard-8.machine_type="e2-standard-8"}node_count=1}

To specify a node pool that uses the default agent, use thenode_config fieldto specify the Logging agent variant asDEFAULT:

resource"google_container_node_pool""with_default_logging_variant"{provider=googlename="example-node-pool-with-default-logging"cluster=google_container_cluster.with_example_logging_variants.namelocation="COMPUTE_LOCATION"node_config{logging_variant="DEFAULT"}node_count=1}

Disable high-throughput logging

If you no longer want to use the high-throughput Logging agent,deploy the default Logging agent to the cluster or node pool.

Warning: Changing the logging agent on an existing node pool recreates allnodes. If you change the logging agent for an existing cluster, the existingnode pools are unaffected and the change only applies to new node pools added tothe cluster.

gcloud CLI

Pass the flag--logging-variant=DEFAULT when you create or update a clusteror node pool.

To use the default logging agent on all nodes in a new cluster:

gcloudcontainerclusterscreateCLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=DEFAULT\--machine-type=MACHINE_TYPE

Replace the following:

To use the default logging agent on an existing cluster:use thegcloud container clusters updatecommand:

gcloudcontainerclustersupdateCLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=DEFAULT

Replace the following:

To use the default logging agent for a new node pool, use thegcloud container node-pools createcommand:

gcloudcontainernode-poolscreateNODEPOOL_NAME\--cluster=CLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=DEFAULT

Replace the following:

  • NODEPOOL_NAME: the name of the new node pool.
  • CLUSTER_NAME: the name of the cluster.
  • COMPUTE_LOCATION: theCompute Engine locationfor the new cluster.

To update an existing node pool, use thegcloud container node-pools updatecommand:

gcloudcontainernode-poolsupdateNODEPOOL_NAME\--cluster=CLUSTER_NAME\--location=COMPUTE_LOCATION\--logging-variant=DEFAULT

Replace the following:

  • NODEPOOL_NAME: the name of the node pool.
  • CLUSTER_NAME: the name of the cluster.
  • COMPUTE_LOCATION: theCompute Engine location.

Terraform

If you no longer want Terraform to create node pools that use the high-throughput Logging agent, set thelogging_variant field toDEFAULT.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-18 UTC.