Filebeat as Daemonset for all Kubernetes Logs (including nginx)

Elastic Stack Beats
2

Hey @sujituk

Those annotations you've mentioned will want to go on the pods that are producing the Nginx logs, rather than the Filebeat Daemonset:

co.elastic.logs/module: nginx
co.elastic.logs/fileset.stdout: access
co.elastic.logs/fileset.stderr: error

This way you can customise the parsing behaviour for logs on a per pod basis.

1 Like