<p>I'm trying to add centralized logging to my kubernetes cluster using EFK. I found out that my logs from pods that are written to system out are stored in journald in my master node. But I want to store those logs in elasticsearch.</p>

<p>Can I change docker config to redirect logs to var logs? I try to avoid to log from my pods in custom location.</p>

<p>Or can I intercept the logs from journald using fluentd or anything else?</p>

<p>Thanks</p>

<p>Please try this <a href="https://www.elastic.co/blog/shipping-kubernetes-logs-to-elasticsearch-with-filebeat" rel="nofollow noreferrer">link</a></p>

<p>The basic idea is to run Filebeat as a daemonset, which will collect and ship logs from containers and push to Elasticsearch.</p>
