What kubectl command can I use to get events sorted by specific fields and print only specific details of events?

I need to print only specific fields of Kubernetes Events, sorted by a specific field.

This is to help me gather telemetry and analytics about my namespace

How could I do that?

kubectl get events --sort-by='.lastTimestamp'

Following command does it.

It prints the events sorted by timestamp of creation.

It also users go-template to filter out specific fields of the kubernetes-event object.

kubectl get events  --sort-by='.metadata.creationTimestamp'  -o 'go-template={{range .items}}{{.involvedObject.name}}{{"\t"}}{{.involvedObject.kind}}{{"\t"}}{{.message}}{{"\t"}}{{.reason}}{{"\t"}}{{.type}}{{"\t"}}{{.firstTimestamp}}{{"\n"}}{{end}}'

I am using the following command to sort it after timestamp

kubectl get event --all-namespaces --sort-by='.metadata.managedFields[0].time'

For filtering out the information you can of course combine it with the go-template described by @suryakrupa or with jq described by @Chris Stryczynski

If you don't mind seeing the output as JSON:

kubectl get event -o json | jq '.items |= sort_by(.lastTimestamp)'

This requires jq.

Here's the Bash function I use:

function kubectl-events {
    {
        echo $'TIME\tNAMESPACE\tTYPE\tREASON\tOBJECT\tSOURCE\tMESSAGE';
        kubectl get events -o json "$@" \
            | jq -r  '.items | map(. + {t: (.eventTime//.lastTimestamp)}) | sort_by(.t)[] | [.t, .metadata.namespace, .type, .reason, .involvedObject.kind + "/" + .involvedObject.name, .source.component + "," + (.source.host//"-"), .message] | @tsv';
    } \
        | column -s $'\t' -t \
        | less -S
}

You can use it like: kubectl-events -A, kubectl-events -n foo, etc.