Flik / Practical guides

Kubernetes / JSON

Filter Kubernetes JSON logs interactively

Make container JSON readable, stack service and error filters, then undo one condition while your investigation stays open.

Updated October 27, 2026 · Flik 0.1.0 · synthetic examples · macOS and Linux

A pod log stream is easy to start and harder to investigate. Nested JSON hides the message, one service produces most of the noise, and every extra condition can mean rebuilding a shell pipeline. This guide keeps that work inside one Flik workspace.

Start with a saved example

Download the synthetic CRI sample. It contains timestamps, stdout/stderr streams and embedded application JSON. No cluster or production logs are needed.

flik container.log

Flik opens at the end. Press g to inspect the sample from its beginning, or G to return to the end. Press w to expand embedded JSON and inspect the service, severity and message without manually unescaping each record.

Stack two filters and undo one

1. Press 3, enter service:payment, then press Enter.
2. Press 3 again and enter level:error.
3. Inspect the remaining payment errors. In the supplied five-record sample, the messages are upstream timeout and payment request failed.
4. Press x. The error filter is removed while the payment-service filter remains. The warning about the connection pool becomes visible again.

This is a refinement workflow: undoing the last condition does not reopen the file or remove the preceding condition. Press Ctrl+F to inspect the filter stack.

Follow a live pod

kubectl logs -f deployment/demo-api | flik -

Replace deployment/demo-api with a workload you can read. Select the namespace or container using kubectl’s own flags when needed. Flik receives the application output; it does not connect to the Kubernetes API or choose a pod for you. Saved CRI files include the container wrapper; kubectl output may contain plain application JSON instead.

Watch the exact keys

The recording uses synthetic data and the actual Flik interface: beautify JSON, add a service filter, add an error filter, undo the last filter.

Know the boundary

Filters depend on fields that exist in the emitted format. Use Tab in search to complete available fields and observed values. If the data is plain text or uses different names, begin with a text search such as /timeout. Flik helps inspect the stream; it does not change Kubernetes retention, fetch events from other pods automatically or establish the cause of an incident.