We have a pod that restarts randomly and we can't find the reason because Kubernetes only keeps event logs only for a short time. Even if we increase it, the logs will be lost when the pod is deleted.
Can someone help me out with the filebeat ConfigMap to log Kubernetes pod events in to Elasticsearch? I've tried different avenues but none of it worked.
I've tried with filebeat.inputs and filebeat.auto-discover but couldn't get it to work. I could get pod logs to be sent but that's not exactly what we need. We want to only send pod state events so that we can figure out what caused the restart and in the meantime to not flood elasticsearch with