Running filebeat as ECS daemon

hey perhaps see my description of a setup

if daemon and 3 nodes in cluster then 3 filebeat instances all reading from 1 volumn - could be a problem, and daemon will have root access to node but not pods files as far ias i know - my testing