Ship logs from Kubernetes to Elasticsearch
By deploying filebeat as a DaemonSet we ensure we get a running filebeat daemon on each node of the cluster.
Docker logs host folder (
/var/lib/docker/containers) is mounted on the
filebeat container. Filebeat will start an input for these files and start
harvesting them as they appear.
Everything is deployed under
kube-system namespace, you can change that by
updating YAML manifests under this folder.
Also, filebeat-daemonset.yaml uses a set of environment variables to configure Elasticsearch output:
|ELASTICSEARCH_USERNAME||elastic||Elasticsearch username for HTTP auth|
If there is an existing
elasticsearch service in the kubernetes cluster these
defaults will use it.