files need to be monitored from different locations within the file system, consider using  multiple volumeMounts and update the filebeat-sidecar-config paths accordingly. After a few minutes (to cater for the containers starting up) the log data should now be visible  in Kibana after the platform Filebeat instance has successfully collected logs from Docker and  pushed them through the default logging mechanism. See Figure 5-32 on page 216. Figure 5-32 Data collected by the Filebeat  Using a Filebeat side car to forward log file messages to Logstash This example will use a simple WebSphere Liberty deployment and Filebeat side car to send  log data from a file populated by WebSphere within the WebSphere container to the external  Elasticsearch used earlier in this chapter, to simulate typical application logs that need to be  sent off-site. As the instance of Logstash uses TLS encryption to secure communications  within the cluster, it’s  important to understand that some certificates will need to be imported  to allow this solution to work. This example will use only the minimum certificates required to  allow communication between the Filebeat sidecar and Logstash. To use a Filebeat side car  to stream logs directly to Logstash, perform the following steps: 1. Copy the required Secret and ConfigMaps to the  sidecar  namespace. Note that doing this  provides any users with access to this namespace the ability to view the authentication  certificates for the platform ELK. In this example, only the required certificates are  extracted from the logging-elk-certs in kube-system. a. Copy the required files from the  logging-elk-certs  Secret: i. Copy the  logging-elk-certs  Secret: ii. Remove all entries in  data except  for the following, using  kubectl -n sidecar edit  secret logging-elk-certs: kubectl -n kube-system get secret logging-elk-certs -o yaml | sed  "s/namespace: kube-system/namespace: sidecar/g" | kubectl -n sidecar  create -f - - ca.crt - filebeat.crt 216  IBM Cloud Private System Administrator’s Guide