Event exporter — the long-term storage for events

event-exporter is the tool for shipping Kubernetes events to long-term storage. The deployment watches the events API and ships the events to the configured sinks. This lesson walks the deployment, the sinks, the configuration, and the production patterns.

The event-exporter

The event-exporter watches the events API and ships the events:

flowchart LR
    A[API server events] --> B[event-exporter]
    B --> C[Loki]
    B --> D[Elasticsearch]
    B --> E[S3]
    B --> F[Webhook]

The event-exporter is the bridge.

The deployment

The deployment:

helm repo add resmo https://resmo-io.github.io/kubernetes-event-exporter
helm install event-exporter resmo/kubernetes-event-exporter \
  --namespace monitoring \
  --values event-exporter-values.yaml

The Helm chart deploys the event-exporter.

The configuration

The configuration:

# event-exporter-values.yaml
config:
  receivers:
    - name: loki
      webhook:
        url: http://loki:3100/loki/api/v1/push
        headers:
          X-Scope-OrgID: "production"
    - name: file
      file:
        path: /data/events
  rules:
    - name: warning-events
      condition: event.type == "Warning"
      receivers:
        - loki
    - name: all-events
      condition: event.type == "Normal" || event.type == "Warning"
      receivers:
        - file

The configuration has the receivers and the rules.

The receivers

The receivers:

The receivers are the destinations.

The rules

The rules:

rules:
  - name: warning-events
    condition: event.type == "Warning"
    receivers:
      - loki
  - name: pod-events
    condition: event.involvedObject.kind == "Pod"
    receivers:
      - loki

The rules filter the events.

The routing

The routing:

route:
  match:
    type: Warning
  receiver: loki
  routes:
    - match:
        involvedObject.kind: Pod
      receiver: file

The routing is the conditional shipping.

The transform

The transform:

transform:
  - name: add-team-label
    type: add
    field: team
    value: "{{ event.involvedObject.namespace }}"

The transform enriches the events.

The deployment with RBAC

The deployment with RBAC:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: event-exporter
rules:
- apiGroups: [""]
  resources:
  - events
  verbs: ["get", "list", "watch"]

The RBAC grants read access to the events.

The event format

The event format:

{
  "type": "Warning",
  "reason": "FailedScheduling",
  "message": "0/5 nodes are available",
  "involvedObject": {
    "kind": "Pod",
    "name": "nginx-1-abc",
    "namespace": "default"
  },
  "firstTimestamp": "2026-08-16T10:00:00Z",
  "lastTimestamp": "2026-08-16T10:00:00Z",
  "count": 1
}

The event format is the JSON representation.

The Loki integration

The Loki integration:

receivers:
  - name: loki
    loki:
      url: http://loki:3100/loki/api/v1/push
      labels:
        job: event-exporter
        cluster: production

The Loki integration is the canonical destination.

The Grafana integration

The Grafana integration:

{service="event-exporter"} |= "FailedScheduling"

The Grafana queries the events via Loki.

The production patterns

The production patterns:

flowchart LR
    A[API server events] --> B[event-exporter]
    B --> C[Loki hot storage]
    B --> D[S3 cold storage]
    C --> E[Grafana]
    D --> F[Compliance]

The pattern is the production flow.

The cross-course references

• The Loki course covers the log storage.
• The Grafana course covers the dashboards.
• The Elasticsearch course covers the ES integration.

Quiz

Production discipline

• Deploy event-exporter. The long-term storage.
• Configure the receivers. Loki, S3, etc.
• Configure the rules. The targeted shipping.
• Use the Loki integration. The canonical destination.
• Document the deployment. The receivers, the rules.
• Test the event-exporter. Verify the events are shipped.

The event-exporter is the cluster’s event long-term storage. Operating it well is the deployment, the receivers, the rules, and the Loki integration.