Filebeat is a lightweight shipper that enables you to send your Kubernetes logs to Logstash and Elasticsearch. Configure Filebeat using the pre-defined examples below to start sending and analysing your Kubernetes logs.
Download the filebeat Kubernetes deploy manifest using the link below:
Open the manifest and around line 76 you should see the environment variables controlling the logging destination. You need to update them to point to your stack.
env: - name: LOGSTASH_HOST value: "your-logstash-host" - name: BEATS_PORT value: "your-port"
Now your deployment manifest is updated, you can deploy it using.
kubectl apply -f filebeat-kubernetes.yaml
kubectl --namespace=kube-system get ds/filebeat kubectl --namespace=kube-system get pods
You should see a pod for each kubernetes node with a name similar to filebeat-abcde listed. The pods should work though from Pending to Running within a couple of minutes as the containers are downloaded and started.