content_image/989033.jpg
<img src='content_image/989033.jpg'>

Important:  At the time of writing, the current Filebeat image runs as the root user within the container, so ensure this complies with your security policies before giving the namespace access to a PodSecurityPolicy that allows containers to be run with the root user. 

## Using a Filebeat side car to forward log file messages to stdout and stderr 

This example will use a simple WebSphere Liberty deployment and Filebeat side car to send log data from a file populated by WebSphere within the WebSphere container to stdout, to simulate typical application logging. This functionality can be achieved in a similar way, by mounting another image, such as busybox, to tail the file and redirect to stdout in the busybox container, but this is not scalable and requires multiple busybox side car containers for multiple log files. Filebeat has a scalability advantage, as well as advanced data processing to output the data to stdout and stderr flexibly. 

To create a WebSphere and Filebeat side car Deployment, perform the following steps: 

1. Create a new namespace called sidecar for this example 

kubectl create namespace sidecar 

2. Creating a ConfigMap for the Filebeat configuration allows you to reuse the same settings for multiple deployments without redefining an instance of Filebeat every time. 

Alternatively, you can create one ConfigMap per deployment if your deployment requires very specific variable settings in Filebeat. This ConfigMap will be consumed by the Filebeat container as its core configuration data. 

Create the ConfigMap in Example 5-33 to store the Filebeat configuration using kubectl create -f filebeat-sidecar-config.yaml. 

apiVersion: v1 kind: ConfigMap metadata: name: filebeat-sidecar-config namespace: sidecar data: filebeat.yml: |- filebeat.prospectors: - input_type: log paths: '${LOG_DIRS}' exclude_lines: '${EXCLUDE_LINES:[]}' include_lines: '${INCLUDE_LINES:[]}' 

