# filebeat-daemonset.yaml apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat namespace: efk spec: selector: matchLabels: app: filebeat template: metadata: labels: app: filebeat spec: containers: - name: filebeat image: docker.elastic.co/beats/filebeat:8.12.0 args: [ "-c", "/etc/filebeat.yml", "-e", "-strict.perms=false" ] volumeMounts: - name: config mountPath: /etc/filebeat.yml readOnly: true subPath: filebeat.yml - name: varlog mountPath: /var/log readOnly: true volumes: - name: config configMap: name: filebeat-config - name: varlog hostPath: path: /var/log