Running filebeat as ECS daemon

Elastic Stack Beats
1

I want to run filebeat as AWS ECS daemon

My plan is to attach volume in filebeat daemon as /var/log/app
and same volumes in all app containers.
Each container will write logs in /var/log/app/$container_id folder

questions:

  1. is my plan ok? or there is better solutions?
  2. can I expose folder ($container_id) name as additional parameter when sending logs?
2

hey perhaps see my description of a setup

if daemon and 3 nodes in cluster then 3 filebeat instances all reading from 1 volumn - could be a problem, and daemon will have root access to node but not pods files as far ias i know - my testing

3

daemon runs one per instance not a container
so If have 3 instances and 3 containers up on each instance in cluster - total 9 containers
I will have 3 filebeat instances each have own volume mounted to host directory

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.