exclude k8s pod logs by default Edit

I believe the default value of exclude_files should list "^/var/log/pods" and "^/var/log/containers" in order to exclude k8s pod logs by default and keep undercloud and overcloud logging separate.

The current setting can be somewhat dangerous, as a malicious pod could try to swamp the log ingestion pipeline with an unusually high rate of log messages, which, in absence of further safeguards, would eventually consume all available space on the storage backend.

It will of course still possible to un-exclude these directories if in some environments harvesting pod logs is actually desired.

Start by locating the default exclude_files setting in the layer-filebeat charm and inspect how its value is rendered into Filebeat configuration. Confirm that /var/log/pods and /var/log/containers are excluded by default while remaining overridable. Done means the default separates Kubernetes pod logs without preventing environments from harvesting them explicitly.

Written by the indexing model from the issue text.