<p>I have a microservice deployed in a Tomcat container/pod. There are four different files generated in the container - access.log, tomcat.log, catalina.out and application.log (log4j output). What is the best approach to send these logs to Elasticsearch (or similar platform). </p>

<p>I read through the information on this <a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/" rel="nofollow noreferrer">page</a> Logging Architecture - Kubernetes 5. Is “Sidecar container with a logging agent” the best option for my use case?</p>

<p>Is it possible to fetch pod labels (e.g.: version) and add it to each line? If it is doable, use a logging agent like fluentd? (I just want to know the direction I should take).</p>

<p>Yes, the best option for your use case is to have to have one <code>tail -f</code> sidecar per log file and then install either a <code>fluentd</code> or a <code>fluent-bit</code> daemonset that will handle shipping and enriching the log events.  </p>

<p>The <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch" rel="nofollow noreferrer">fluentd elasticsearch</a> cluster addon is available at that link.  It will install a fluentd daemonset and a minimal ES cluster.  The ES cluster is not production ready so please see the README for details on what must be changed.</p>
