Collect Kubernetes container logs with filelog receiver and k8sattributes processor

Steps

1. Deploy the Collector as a DaemonSet so one instance runs on each node and can access that node's container log files; mount /var/log/pods and /var/log/containers from the host into the Collector container
2. Configure the filelog receiver to include /var/log/pods/*/*/*.log; add a container operator (type: container) to automatically detect and parse CRI-O or Docker JSON log format without manual per-runtime config
3. Add the k8sattributes processor to the log pipeline; set auth_type: serviceAccount and configure extract.metadata to pull k8s.pod.name, k8s.namespace.name, k8s.node.name, k8s.container.name, and relevant pod labels/annotations
4. Grant the DaemonSet ServiceAccount RBAC permissions: pods/get, pods/list, pods/watch on the core API group and namespaces/get so the processor can resolve pod metadata from the Kubernetes API
5. Add a resource processor after k8sattributes to promote frequently queried metadata (cluster name, environment) into resource attributes rather than log attributes for efficient backend indexing
6. Use the Helm chart's logsCollection and kubernetesAttributes presets (--set presets.logsCollection.enabled=true) to generate a validated baseline DaemonSet config that you can then customise