# Should deploy filebeat as POD service~~?

**URL:** <https://discuss.elastic.co/t/should-deploy-filebeat-as-pod-service/209267>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 25, 2019, 9:45am UTC](https://discuss.elastic.co/t/should-deploy-filebeat-as-pod-service/209267 "2019-11-25T09:45:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomyui](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@tomyui](https://discuss.elastic.co/u/tomyui)\
**Post date:** [November 25, 2019, 9:45am UTC](https://discuss.elastic.co/t/should-deploy-filebeat-as-pod-service/209267/1 "2019-11-25T09:45:06Z")

</div>

Hi everyone,

my organization is use OpenShift with tomcat for hosting application services.  
I need to use filebeat to monitor server logs & application logs, send to logstash.

I have read thru. the doc about deploying filebeat on Openshift (kubernetes)  
[https://www.elastic.co/guide/en/beats/filebeat/6.8/running-on-kubernetes.html](https://www.elastic.co/guide/en/beats/filebeat/6.8/running-on-kubernetes.html)

I know that filebeat can be:  
**option A.)** installed on OS, 1 filebeat instance per OS host.  
**option B.)** installed as a pod service and use daemonset to config 1 filebeat POD service per worker node (mentioned in above doc).  
**option C.)** package filebeat binary with application as 1 container image and run filebeat inside application container

The logs are writing to a persistence volume across OpenShift worker nodes.

Option C is not a good choice i think. Which option is a better choice for my case and what are the pros & cons to help me decide which one is a better approach?

For option B, any problems if I put the data.registry into a common persistence volume for several filebeat to prevent duplicate log entries?

Or could you share your approaches doing now please. thx so much.

Regards.  
Tom

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2019, 9:45am UTC](https://discuss.elastic.co/t/should-deploy-filebeat-as-pod-service/209267/2 "2019-12-23T09:45:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.