my organization is use OpenShift with tomcat for hosting application services.
I need to use filebeat to monitor server logs & application logs, send to logstash.
I have read thru. the doc about deploying filebeat on Openshift (kubernetes)
I know that filebeat can be:
option A.) installed on OS, 1 filebeat instance per OS host.
option B.) installed as a pod service and use daemonset to config 1 filebeat POD service per worker node (mentioned in above doc).
option C.) package filebeat binary with application as 1 container image and run filebeat inside application container
The logs are writing to a persistence volume across OpenShift worker nodes.
Option C is not a good choice i think. Which option is a better choice for my case and what are the pros & cons to help me decide which one is a better approach?
For option B, any problems if I put the data.registry into a common persistence volume for several filebeat to prevent duplicate log entries?
Or could you share your approaches doing now please. thx so much.