Filebeat configuration

Hello all,

This week I started looking into ELK to monitor our K8s cluster. Sorry if this is a newbie question :slight_smile:

I installed ELK (Elastic and Kibana) on a separate VM (not running on K8s) using Docker Compose as documented here: Running the Elastic Stack ("ELK") on Docker | Getting Started [8.2] | Elastic

On a separate K8s cluster I'm running Filebeat as documented here: Run Filebeat on Kubernetes | Filebeat Reference [8.2] | Elastic

So far so good, using the Observability / Logs (stream) I can see the logs from the K8s cluster coming into ELK.

Reading the documentation (e.g. Run Filebeat on Kubernetes | Filebeat Reference [8.2] | Elastic and Monitoring Kubernetes the Elastic way using Filebeat and Metricbeat | Elastic Blog), I'm a little confused about the following:

  • Should I also install Filebeat (using Docker) on the ELK stack itself, besides running Filebeat on the K8s cluster?
  • Especially with respect to the out-of-the-box Kibana dashboards for Filebeat? See Run Filebeat on Kubernetes | Filebeat Reference [8.2] | Elastic
  • Is there any Integration / App / Dashboard for Kibana you recommend using to view/inspect/analyse the logs coming in from the Filebeat running on K8s besides using the Log application in Kibana?

Many thanks!

Ronald