helm repo add elastic https://helm.elastic.co
helm repo update
helm install filebeat elastic/filebeat -n elk-stack -f logs/beats-values.yaml

daemonset:
  enabled: true

  extraVolumes:
    - name: journald-logs
      hostPath:
        path: /run/log/journal/
        type: Directory
  extraVolumeMounts:
    - name: journald-logs
      mountPath: /run/log/journal/

  hostNetworking: true

  # Allows you to add any config files in /usr/share/filebeat such as filebeat.yml for daemonset
  filebeatConfig:
    filebeat.yml: |
      filebeat.inputs:
      
      - type: journald
        seek: head
        paths:
          - /var/log/journal/
          - /run/log/journal/

      output.elasticsearch:
        hosts: 'es01:9200'
        username: '${ELASTICSEARCH_USERNAME}'
        password: '${ELASTICSEARCH_PASSWORD}'
        protocol: http

  secretMounts: []

  securityContext:
    # - User that the container will execute as. Typically necessary to run as root (0) in order to properly collect host container logs.
    runAsUser: 0
    # - Whether to execute the Filebeat containers as privileged containers. Typically not necessarily unless running within environments such as OpenShift.
    privileged: true

deployment:
  enabled: false