We will start deploying our java applications using docker on AWS elasticbeanstalk, we want centralized logging and will be using ELK stack.
I would like keep one process per container, therefore avoid using filebeat, but in order to do that we would have to use a different appender like syslog or even a tcp appender.
We can't afford losing logs.
Filebeat provides retrial logic out of the box, but introducing it into the mix would increase deployment complexity, would need to make sure filebeat receives SIGTERM when containers are terminated, make sure it's pre-baked into container image or in the Dockerfile, and so on.
If we go down the path using tcp or syslog appender, retrial is up to us, and we want avoid complexity on our code too.
What are the pros and cons of each approach, in addition to what I've pointed?
Our logging library is logback.