title: K8S EFK (especially Fluentd) daemonset for docker journald logging driver
body: <h1>Question</h1>
  <p>Are there known available Fluentd daemonset for <strong>journald docker logging driver</strong> so that I can send K8S pod logs to Elasticsearch?</p>
  <h2>Background</h2>
  <p>As in <a href="https://github.com/kubernetes/kubernetes/pull/42470" rel="nofollow noreferrer">add support to log in kubeadm</a>, the default logging driver for K8S installed by kubeadm is journald.</p>
  <blockquote>
  <p>the community is collectively moving away from files on disk at every place possible in general, and this would unfortunately be a step backwards. ...</p>
  <p>You can edit you /etc/docker/daemon.json to set its default log to json files and set a max size and max files to take care of the log rotation. After that, logs wont be written to journald and you will be able to send your log files to ES.</p>
  </blockquote>
  <p>However, the <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch" rel="nofollow noreferrer">K8S EFK addon</a> and <a href="http://Kubernetes%20Logging%20with%20Fluentd" rel="nofollow noreferrer">Fluentd K8S</a> or <a href="https://coreos.com/tectonic/docs/latest/admin/logging.html" rel="nofollow noreferrer">Aggregated Logging in Tectonic</a> still expect to look for files in /var/log/containers in the host, if I understood correctly.</p>
  <p>It looks <a href="https://github.com/emacski/k8s-fluentd" rel="nofollow noreferrer">Alternative fluentd docker image designed as a drop-in replacement for the fluentd-es-image</a> looks to be adopting journald driver. However could not make it run the pods.</p>