This architecture depends upon the application and many other factors. Following are the common logging patterns
* Node level logging agent.
* Streaming sidecar container.
* Sidecar container with the logging agent.
* Export logs directly from the application.
In the setup, journalbeat and filebeat are running as daemonset. Logs collected by these are dumped to the kafka topic which is eventually dumped to the ELK stack.
The same can be achieved using EFK stack and fluentd-bit.
