# Pushing different types of (access, application) logs using filebeat-daemonset in Kubernetes
**URL:** https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353
**Category:** Beats
**Tags:** filebeat
**Created:** [January 17, 2021, 3:58pm UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353 "2021-01-17T15:58:07Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@JasminShah](https://discuss.elastic.co/u/JasminShah)
#### Post date: [January 17, 2021, 3:58pm UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353/1 "2021-01-17T15:58:08Z")
I have several pods running spring-boot applications, writing application-logs to stdout, which is then picked up by filebeat-daemonset and then pushed to elasticsearch. (standard logging architecture for kubernetes)
Now, I need to enable [tomcat-access-logs](https://www.baeldung.com/spring-boot-embedded-tomcat-logs#enable-access) in spring-boot applications. Should I enable it and make them write to `stdout` as well? So the same container would write two types of logs to `stdout` . The issue would be, both (application, access) logs will have different patterns. I need to dissect them differently so that in kibana, I can setup indices based on them.
With filebeat, can we configure different log-patterns (and then dissect) from the same source ( `stdout` , in this case)? Are there any known best practices for this requirement? In VM-based deployments, I used to have more than one filebeat.yml files for a single filebeat, which were reading log-files from different sources (/var/log/application\*.log, /var/log/access\*.log).
I have asked same question on [Stackoverflow](https://stackoverflow.com/questions/65599663/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-i) (with sample code) if you could please help.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [January 18, 2021, 8:45am UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353/2 "2021-01-18T08:45:00Z")
The common practice is to involve the ingest node pipeline. See this thread: [Best practice for Logging with Filebeat](https://discuss.elastic.co/t/best-practice-for-logging-with-filebeat/131479/2)
---
### Author:  [@JasminShah](https://discuss.elastic.co/u/JasminShah)
#### Post date: [February 3, 2021, 11:43am UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353/3 "2021-02-03T11:43:54Z")
Thanks @mtojek for the recommendations. Can you please add more info on how ingest node pipeline would help in my scenario?
Apologies, as I am not able to visualize the solution here.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 3, 2021, 1:44pm UTC](https://discuss.elastic.co/t/pushing-different-types-of-access-application-logs-using-filebeat-daemonset-in-kubernetes/261353/4 "2021-03-03T13:44:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.