I'm using rancher, and I'm trying to setup a container to read from all the configured log directories on the host filesystem (i.e. /var/log).
However, the default id used by docker.elastic.co/beats/filebeat:6.2.2 is
1000. So, it can't read anything it doesn't have ownership of.
Is there a best practice for this? Should I be using logstash or a shipper instead?