Rancher ONAP OOM deployment do not deploy ONAP Filebeat properly. The owner of filebeat.yml  should not root. We cannot modify filebeat.yml for ONAP Portal component to add or change path for additional ONAP Portal log files. 

Filebeat container deployed with ONAP Portal component. This issue is across all ONAP components (Portal, vid,, .....) 

sh-4.2$ pwd

/usr/share/filebeat

sh-4.2$ ls -la

rw-r---- 1 root filebeat    24331 Jun 30  2017 filebeat.template-es2x.json

rw-r---- 1 root filebeat    19455 Jun 30  2017 filebeat.template-es6x.json

rw-r---- 1 root filebeat    19503 Jun 30  2017 filebeat.template.json

rw-rr- 1 root root         1889 Jun 11 18:57 filebeat.yml

drwxrwx--- 2 root filebeat     4096 Jul  6  2017 logs

drwxr-x--- 1 root filebeat     4096 Jul  6  2017 module