Kubernetes already writes container logs on every node. The Logit way is to run a cluster-side shipper that forwards those logs into a hosted log stack — managed Logstash ingestion and OpenSearch search — instead of standing up Elasticsearch yourself with Helm. This post is the customer path: create a stack, deploy what the live docs specify, and verify in Dashboards.
Contents
What Logit runs for you
On Logit.io, a Logs stack gives you the ingestion endpoint and OpenSearch-backed storage for observability. You do not install Elasticsearch or OpenSearch into the cluster for this path. Your job in Kubernetes is to collect stdout/stderr (and related container files under /var/log/containers/) and ship them securely to Logstash.
Context for cluster logging vs metrics, and links into the detailed manifests, are in Getting started with Kubernetes.
Shipper the docs recommend
The current Kubernetes integration walks a Filebeat DaemonSet: a ConfigMap with filebeat.yml (container input + add_kubernetes_metadata), RBAC, and a pod per node that outputs to Logstash over SSL. That is the authoritative install path — copy the manifest from the docs (or the dashboard Install Integration flow), substitute your Logstash host and Beats SSL port from the stack, then apply with kubectl.
Confirm the DaemonSet and pods are Running in the target namespace (the docs example uses kube-system). You should see one Filebeat pod per node after images pull.
Other shippers exist in the broader ecosystem, but for Logit’s published Kubernetes logging guide, follow Filebeat as documented rather than improvising a different agent.
Unlock complete visibility with hosted ELK, Grafana, and Prometheus-backed Observability
Create the stack and install
Create or open a Logs stack in the dashboard. Use View Data Integrations (or the Kubernetes integration page) and click Install Integration so the stack is ready for this source. Copy host and port into the manifest environment variables exactly as shown — placeholders like your-logstash-host will not ingest.
Apply the updated YAML, wait for pods to become Ready, then generate traffic or wait for existing workloads to emit logs. Cluster and application logs both land when the container input covers /var/log/containers/*.log as in the docs example.
Verify in OpenSearch Dashboards
From the Logs stack, launch OpenSearch Dashboards and open Discover. Filter on Kubernetes metadata fields Filebeat adds (pod, namespace, container) or on a known application string. If pods are Running but Discover is empty, re-check SSL host/port, RBAC, and that the volume mounts for /var/log and container log paths match the published manifest.
Dashboards overview for log stacks: OpenSearch Dashboards overview.
Metrics are a separate path
The same Kubernetes docs section covers metrics via Telegraf (Helm) into your metrics product — useful next, but optional for first log value. Keep logs and metrics onboarding separate so a metrics chart issue does not block proving container log delivery.
Operational checklist
Before you call the integration done, tick a short list: Filebeat DaemonSet desired equals node count; pods are Running (not CrashLoop); Logstash host and Beats SSL port match the stack Endpoints card; Discover shows recent documents with Kubernetes metadata; and a test deploy’s logs appear under the expected namespace.
When volume grows, revisit multiline handling for stack traces, drop noisy debug streams at the shipper or in Logstash, and add alerts for error spikes rather than relying on manual Discover only. Keep using Kubernetes logging as the source of truth for manifest updates when Filebeat image versions change in the docs.
For teams comparing approaches, remember the product split: Logit hosts Logstash and OpenSearch; you own the DaemonSet, RBAC, and node resources. That is the trade that removes Elasticsearch Helm operations from your cluster while keeping log delivery under your control.
Pair this with Getting started with Kubernetes when you are ready for metrics via Telegraf, after logs are proven.
What this is not
This is not a guide to Helm-install Elasticsearch or operate a self-hosted ELK control plane inside the cluster. Logit hosts the search backend; you host the shipper. For production, revisit retention, multiline parsing, and alerts after Discover shows healthy volume from your namespaces.