content_image/989102.jpg
files need to be monitored from different locations within the file system, consider using multiple volumeMounts and update the filebeat-sidecar-config paths accordingly. 

After a few minutes (to cater for the containers starting up) the log data should now be visible in Kibana after the platform Filebeat instance has successfully collected logs from Docker and pushed them through the default logging mechanism. See Figure 5-32 on page 216. 

<img src='content_image/989102.jpg'>

## Using a Filebeat side car to forward log file messages to Logstash 

This example will use a simple WebSphere Liberty deployment and Filebeat side car to send log data from a file populated by WebSphere within the WebSphere container to the external Elasticsearch used earlier in this chapter, to simulate typical application logs that need to be sent off-site. As the instance of Logstash uses TLS encryption to secure communications within the cluster, it’s important to understand that some certificates will need to be imported to allow this solution to work. This example will use only the minimum certificates required to allow communication between the Filebeat sidecar and Logstash. To use a Filebeat side car to stream logs directly to Logstash, perform the following steps: 

1. Copy the required Secret and ConfigMaps to the sidecar  namespace. Note that doing this provides any users with access to this namespace the ability to view the authentication certificates for the platform ELK. In this example, only the required certificates are extracted from the logging-elk-certs in kube-system. 

a. Copy the required files from the logging-elk-certs  Secret: 

i. Copy the logging-elk-certs  Secret: 

kubectl -n kube-system get secret logging-elk-certs -o yaml | sed "s/namespace: kube-system/namespace: sidecar/g" | kubectl -n sidecar create -f - 

ii. Remove all entries in data except  for the following, using kubectl -n sidecar edit secret logging-elk-certs: 

- ca.crt 

- filebeat.crt 

