Is it possible to retrieve only new logs after recreating LogWatch after closed connection?

[if-of]

I use LogWatch to receive real-time logs from pods. However, there is an issue where LogWatch stops receiving logs after 4 hours, and this appears to be linked to a hardcoded 4-hour connection timeout in Kubernetes (reference here). On the other side, it seems that this timeout can be configured using the streamingConnectionIdleTimeout parameter, as mentioned (here). Unfortunately, AKS does not offer this configuration option.

Is there a way to only retrieve new logs after recreating LogWatch? Currently, when I recreate LogWatch, it restarts log retrieval from the beginning, which can be resource-intensive given the need to re-receive all logs for the past 4 hours.

[shawkins]

Is there a way to only retrieve new logs after recreating LogWatch? Currently, when I recreate LogWatch, it restarts log retrieval from the beginning, which can be resource-intensive given the need to re-receive all logs for the past 4 hours.

There are a couple of parameters supported by the log operation - sinceSeconds, and sinceTime. I'm not sure there's a better reference for it, so here's from the kube source https://github.com/kubernetes/kubectl/blob/master/pkg/cmd/logs/logs.go#L176

You can set this prior to the watchLog method:

pod.sinceSeconds("4h").watchLog(out)