Filebeat for Openshift and Kubernetes audit logs

Elastic Stack Beats
1

Hi,

What’s the best way to collect Openshift and Kubernetes audit logs with Filebeats?

Auditbeat doesn’t seem to have any options to inspect Kube or OCP audit log files.

Thanks,
Sayeed

2

Anyone with an update? Should I use Filebeats or Auditbeat for these logs?

3

How about experimenting yourself with FB's auditd module? Did you try and got some results? See: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html

4

I'll test it out. Thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.