Configuring filebeats for persistentVolumes in a cluster with multiple nodes

I have a cluster with 3 master and 8 worker nodes. I have deployed filebeats in pods on each of the worker nodes to gather container logs. What I also have done is create a pod that writes to a persistentVolumeClaim in a particular directory (/var/log) on that volume. Type is NFS. So how does know filebeat how to read from that volume that is associated with that pod or is that even possible? What would this configuration look like for filebeats. I am a bit new to Kuber and filebeats so you help would be appreciated. When the pod with the PVC writes to a file, it is on one of the nodes where the filebeats pod is deployed so I am assuming that since the volume is accessible by all the nodes that it should be able to read it. Is it just going to the containers dir and I can still grab that file using inclusions/excludes?

Close this topic. The PVC is mounted across all nodes and depending on the setup, the directory is mounted off of this mount on each node. I.E. /var/lib/kubelet/pods/. Any pod can then use the mount if correctly configured to use that PVC or mount that dir within it's pod. If it is an empty dir (on pod only) then this is (I believe) only memory space. It is not accessible outside of the pod, but can be accessible within the pod by other containers if the access is allowed? (not positive on this) Anyone know?

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.