bokamba / loganvil / Kubernetes (klog) logs

$ loganvil generate k8s

Generate synthetic Kubernetes (klog) logs

Generate realistic synthetic Kubernetes (klog) logs for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line follows the klog controller format — level letter, MMDD HH:MM:SS timestamp, pid, source:line, quoted message, and namespace/name/reason key=value pairs — so it exercises a klog-aware parser exactly. No real clusters or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of Kubernetes (klog) logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.3stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated Kubernetes (klog) logs

Real on-the-wire Kubernetes (klog) logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

WSep 13 12:26:40 14744 controller.go:867] "Object created" namespace="shop" name="cache" reason="ImagePullBackOff
ESep 13 12:26:40 15529 controller.go:324] "Requeueing" namespace="kube-system" name="api" reason="Scheduled
ESep 13 12:26:40 20047 controller.go:103] "Sync failed" namespace="default" name="web" reason="Created
ISep 13 12:26:40 2118 controller.go:267] "Requeueing" namespace="kube-system" name="web" reason="Scheduled
WSep 13 12:26:41 26529 controller.go:387] "Sync failed" namespace="shop" name="web" reason="Created
ISep 13 12:26:41 21193 controller.go:288] "Sync failed" namespace="kube-system" name="worker" reason="Created
ISep 13 12:26:41 9671 controller.go:167] "Object created" namespace="kube-system" name="cache" reason="BackOff
ESep 13 12:26:42 14184 controller.go:948] "Reconciling object" namespace="shop" name="web" reason="ImagePullBackOff
WSep 13 12:26:42 29486 controller.go:169] "Object created" namespace="default" name="api" reason="Created
WSep 13 12:26:42 26949 controller.go:208] "Requeueing" namespace="kube-system" name="worker" reason="ImagePullBackOff
WSep 13 12:26:43 19577 controller.go:390] "Object created" namespace="infra" name="api" reason="BackOff
ESep 13 12:26:43 29180 controller.go:488] "Object created" namespace="infra" name="web" reason="Created
ESep 13 12:26:43 29657 controller.go:184] "Sync failed" namespace="default" name="web" reason="BackOff
ESep 13 12:26:44 22957 controller.go:300] "Sync failed" namespace="shop" name="cache" reason="ImagePullBackOff
WSep 13 12:26:44 29072 controller.go:393] "Requeueing" namespace="infra" name="web" reason="BackOff

With an anomaly injected: Port scan

The same source, regenerated with a Port scan injected at 30% intensity. 7 line sare tagged and highlighted below — One source IP hitting many sequential destination ports — reconnaissance sweeping for open services. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

WSep 13 12:26:40 14744 controller.go:867] "Object created" namespace="shop" name="cache" reason="ImagePullBackOff
ESep 13 12:26:40 15529 controller.go:324] "Requeueing" namespace="kube-system" name="api" reason="Scheduled
ESep 13 12:26:40 20047 controller.go:103] "Sync failed" namespace="default" name="web" reason="Created
ISep 13 12:26:40 2118 controller.go:267] "Requeueing" namespace="kube-system" name="web" reason="Scheduled
WSep 13 12:26:41 26529 controller.go:387] "Sync failed" namespace="shop" name="web" reason="Created
ISep 13 12:26:41 21193 controller.go:288] "Sync failed" namespace="kube-system" name="worker" reason="Created
ISep 13 12:26:41 9671 controller.go:167] "Object created" namespace="kube-system" name="cache" reason="BackOff
ESep 13 12:26:42 14184 controller.go:948] "Reconciling object" namespace="shop" name="web" reason="ImagePullBackOff
srcip=162.243.128.12 dstip=203.0.113.229 dstport=78 action=deny sentbyte=98Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=79 action=deny sentbyte=115Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=80 action=deny sentbyte=62Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=81 action=deny sentbyte=97Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=82 action=deny sentbyte=54Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=83 action=deny sentbyte=82Port scan
srcip=162.243.128.12 dstip=203.0.113.229 dstport=84 action=deny sentbyte=106Port scan

FAQ

Are these real Kubernetes logs?
No — the output is synthetic. It reproduces the klog controller line shape (level letter, timestamp, pid, file:line, message, namespace/name/reason), but every value is fabricated. Safe for fixtures, demos and parser tests.
Can I inject anomalies?
Yes. All five patterns are available; for this source a port scan is appended in faithful grammar, and the injected lines are highlighted and badged so you can prove your rules fire.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical klog lines, so a committed seed regenerates the identical log on any machine or in CI.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own Kubernetes (klog) logs

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →