Repository: elastic/cloud-on-k8s

Issue:
File/Metricbeat need logs volume when readOnlyRootFilesystem is enabled with stack monitoring.
When `readOnlyRootFilesystem` is enabled for Elasticsearch or Kibana and stack monitoring is enabled both filebeat and metricbeat need an `emptyDir` volume to write logs otherwise they receive an error when attempting to write any logs to their logs directory as can happen when indexing errors occur, and a new event file is attempted to be written:

```
write error: failed to open new log file for writing: failed to open new file '/usr/share/filebeat/logs/filebeat-events-data-20250328.ndjson': open /usr/share/filebeat/logs/filebeat-events-data-20250328.ndjson: read-only file system
```

Discussion:

Solution patch:
diff --git a/build/Dockerfile b/build/Dockerfile
index 88e9a0adb..06c9ee71e 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,5 +1,5 @@
 # Build the operator binary
-FROM docker.elastic.co/wolfi/go:1.24.1-r2@sha256:6e18c3fd770a781fe68c823c64ba7deae0a73dbc50dbe8e579224563892e50c5 as builder
+FROM docker.elastic.co/wolfi/go:1.24.2@sha256:849af5880149a3eea057c2fa1ceacf69a52de81c90e68001d3d9a1bd0a0c726f as builder
 
 ARG VERSION
 ARG SHA1
@@ -27,7 +27,7 @@ RUN --mount=type=cache,mode=0755,target=/go/pkg/mod \
 
 # ---------------------------------------------
 # Copy the operator binary into a lighter image
-FROM docker.elastic.co/wolfi/static:latest@sha256:9276a4ebe6b98cd1bbd53b8139228434a0e4f00d06d39e33688e9bd759986656
+FROM docker.elastic.co/wolfi/static:latest@sha256:2e3db1641bb4fe4e85d2210f4aadb79252e90d5fa745f53a3ffed6a1aab4f73b
 
 ARG VERSION
 
diff --git a/build/Dockerfile-ubi b/build/Dockerfile-ubi
index c7aaf287d..2722e4b60 100644
--- a/build/Dockerfile-ubi
+++ b/build/Dockerfile-ubi
@@ -1,5 +1,5 @@
 # Build the operator binary
-FROM docker.elastic.co/wolfi/go:1.24.1-r2@sha256:6e18c3fd770a781fe68c823c64ba7deae0a73dbc50dbe8e579224563892e50c5 as builder
+FROM docker.elastic.co/wolfi/go:1.24.2@sha256:849af5880149a3eea057c2fa1ceacf69a52de81c90e68001d3d9a1bd0a0c726f as builder
 
 ARG VERSION
 ARG SHA1
diff --git a/hack/helm/release/go.mod b/hack/helm/release/go.mod
index 9398bcb98..29266813b 100644
--- a/hack/helm/release/go.mod
+++ b/hack/helm/release/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/spf13/viper v1.20.1
 	google.golang.org/api v0.227.0
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.17.2
+	helm.sh/helm/v3 v3.17.3
 )
 
 replace github.com/elastic/cloud-on-k8s/v3 => ../../..
diff --git a/hack/helm/release/go.sum b/hack/helm/release/go.sum
index 684afa297..001621f65 100644
--- a/hack/helm/release/go.sum
+++ b/hack/helm/release/go.sum
@@ -561,8 +561,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.17.2 h1:agYQ5ew2jq5vdx2K7q5W44KyKQrnSubUMCQsjkiv3/o=
-helm.sh/helm/v3 v3.17.2/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
+helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
 k8s.io/api v0.32.3 h1:Hw7KqxRusq+6QSplE3NYG4MBxZw1BZnq4aP4cJVINls=
 k8s.io/api v0.32.3/go.mod h1:2wEDTXADtm/HA7CCMD8D8bK4yuBUptzaRhYcYEEYA3k=
 k8s.io/apiextensions-apiserver v0.32.2 h1:2YMk285jWMk2188V2AERy5yDwBYrjgWYggscghPCvV4=
diff --git a/hack/manifest-gen/Dockerfile b/hack/manifest-gen/Dockerfile
index cd2d01599..581444ad3 100644
--- a/hack/manifest-gen/Dockerfile
+++ b/hack/manifest-gen/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.elastic.co/wolfi/go:1.24.1-r2@sha256:6e18c3fd770a781fe68c823c64ba7deae0a73dbc50dbe8e579224563892e50c5 as builder
+FROM docker.elastic.co/wolfi/go:1.24.2@sha256:849af5880149a3eea057c2fa1ceacf69a52de81c90e68001d3d9a1bd0a0c726f as builder
 ADD . /manifest-gen
 WORKDIR /manifest-gen
 ENV GO111MODULE=on CGO_ENABLED=0 GOOS=linux 
diff --git a/hack/manifest-gen/go.mod b/hack/manifest-gen/go.mod
index 7f6c8d903..99ddd7970 100644
--- a/hack/manifest-gen/go.mod
+++ b/hack/manifest-gen/go.mod
@@ -6,7 +6,7 @@ toolchain go1.24.2
 
 require (
 	github.com/spf13/cobra v1.9.1
-	helm.sh/helm/v3 v3.17.2
+	helm.sh/helm/v3 v3.17.3
 	sigs.k8s.io/kustomize/kyaml v0.19.0
 )
 
diff --git a/hack/manifest-gen/go.sum b/hack/manifest-gen/go.sum
index 2fc55973e..e48f2557b 100644
--- a/hack/manifest-gen/go.sum
+++ b/hack/manifest-gen/go.sum
@@ -446,8 +446,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.17.2 h1:agYQ5ew2jq5vdx2K7q5W44KyKQrnSubUMCQsjkiv3/o=
-helm.sh/helm/v3 v3.17.2/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
+helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
+helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
 k8s.io/api v0.32.2 h1:bZrMLEkgizC24G9eViHGOPbW+aRo9duEISRIJKfdJuw=
 k8s.io/api v0.32.2/go.mod h1:hKlhk4x1sJyYnHENsrdCWw31FEmCijNGPJO5WzHiJ6Y=
 k8s.io/apiextensions-apiserver v0.32.2 h1:2YMk285jWMk2188V2AERy5yDwBYrjgWYggscghPCvV4=
diff --git a/pkg/controller/beat/common/stackmon/stackmon.go b/pkg/controller/beat/common/stackmon/stackmon.go
index a005535de..4cf5d4e3b 100644
--- a/pkg/controller/beat/common/stackmon/stackmon.go
+++ b/pkg/controller/beat/common/stackmon/stackmon.go
@@ -10,18 +10,25 @@ import (
 	"errors"
 	"fmt"
 
-	corev1 "k8s.io/api/core/v1"
-
 	"github.com/elastic/cloud-on-k8s/v3/pkg/apis/beat/v1beta1"
 	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/association"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon/monitoring"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/version"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/volume"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/bootstrap"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/utils/k8s"
 )
 
+const (
+	FilebeatLogsVolumeName      string = "filebeat-logs"
+	FilebeatLogsVolumeMountPath string = "/usr/share/filebeat/logs"
+
+	MetricbeatLogsVolumeName      string = "metricbeat-logs"
+	MetricbeatLogsVolumeMountPath string = "/usr/share/metricbeat/logs"
+)
+
 var (
 	// filebeatConfig is a static configuration for Filebeat to collect Beats logs
 	//go:embed filebeat.yml
@@ -43,17 +50,10 @@ func Filebeat(ctx context.Context, client k8s.Client, resource monitoring.HasMon
 	}
 
 	// Add shared volume for logs consumption.
-	sidecar.Container.VolumeMounts = append(sidecar.Container.VolumeMounts, corev1.VolumeMount{
-		Name:      "filebeat-logs",
-		MountPath: "/usr/share/filebeat/logs",
-		ReadOnly:  false,
-	})
-	sidecar.Volumes = append(sidecar.Volumes, corev1.Volume{
-		Name: "filebeat-logs",
-		VolumeSource: corev1.VolumeSource{
-			EmptyDir: &corev1.EmptyDirVolumeSource{},
-		},
-	})
+	filebeatLogsVolume := volume.NewEmptyDirVolume(FilebeatLogsVolumeName, FilebeatLogsVolumeMountPath)
+	sidecar.Container.VolumeMounts = append(sidecar.Container.VolumeMounts, filebeatLogsVolume.VolumeMount())
+	sidecar.Volumes = append(sidecar.Volumes, filebeatLogsVolume.Volume())
+
 	return sidecar, nil
 }
 
@@ -91,17 +91,14 @@ func MetricBeat(ctx context.Context, client k8s.Client, beat *v1beta1.Beat) (sta
 	}
 
 	// Add shared volume for Unix socket between containers.
-	sidecar.Container.VolumeMounts = append(sidecar.Container.VolumeMounts, corev1.VolumeMount{
-		Name:      "shared-data",
-		MountPath: "/var/shared",
-		ReadOnly:  false,
-	})
-	sidecar.Volumes = append(sidecar.Volumes, corev1.Volume{
-		Name: "shared-data",
-		VolumeSource: corev1.VolumeSource{
-			EmptyDir: &corev1.EmptyDirVolumeSource{},
-		},
-	})
+	sharedDataVolume := volume.NewEmptyDirVolume("shared-data", "/var/shared")
+	sidecar.Container.VolumeMounts = append(sidecar.Container.VolumeMounts, sharedDataVolume.VolumeMount())
+	sidecar.Volumes = append(sidecar.Volumes, sharedDataVolume.Volume())
+
+	// Add shared volume for logs consumption.
+	metricbeatLogsVolume := volume.NewEmptyDirVolume(MetricbeatLogsVolumeName, MetricbeatLogsVolumeMountPath)
+	sidecar.Volumes = append(sidecar.Volumes, metricbeatLogsVolume.Volume())
+	sidecar.Container.VolumeMounts = append(sidecar.Container.VolumeMounts, metricbeatLogsVolume.VolumeMount())
 
 	return sidecar, nil
 }
diff --git a/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
index d8db7a0de..5cd89d5e9 100755
--- a/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/elasticsearch/stackmon/__snapshots__/sidecar_test.snap
@@ -296,6 +296,10 @@ setup.template.settings:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    }
@@ -319,6 +323,10 @@ setup.template.settings:
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-metricbeat-config",
     "secret": {
@@ -424,6 +432,10 @@ setup.template.settings:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/elasticsearch/logs",
       "name": "elasticsearch-logs"
@@ -443,6 +455,10 @@ setup.template.settings:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
@@ -552,6 +568,10 @@ setup.template.settings:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -627,6 +647,10 @@ setup.template.settings:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/elasticsearch/logs",
       "name": "elasticsearch-logs"
@@ -653,10 +677,18 @@ setup.template.settings:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
@@ -773,6 +805,10 @@ setup.template.settings:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -848,6 +884,10 @@ setup.template.settings:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/elasticsearch/logs",
       "name": "elasticsearch-logs"
@@ -881,10 +921,255 @@ setup.template.settings:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
+   {
+    "name": "sample-filebeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-monitoring-filebeat-config"
+    }
+   },
+   {
+    "name": "sample-metricbeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-monitoring-metricbeat-config"
+    }
+   }
+  ]
+ }
+}
+---
+
+[TestWithMonitoring/with_metrics_and_logs_monitoring_and_read_only_root_filesystem - 1]
+{
+ "metadata": {
+  "annotations": {
+   "elasticsearch.k8s.elastic.co/monitoring-config-hash": "1805099278"
+  },
+  "creationTimestamp": null
+ },
+ "spec": {
+  "automountServiceAccountToken": false,
+  "containers": [
+   {
+    "env": [
+     {
+      "name": "ES_LOG_STYLE",
+      "value": "file"
+     }
+    ],
+    "name": "elasticsearch",
+    "resources": {}
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/metricbeat-config/metricbeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/metricbeat:7.14.0",
+    "name": "metricbeat",
+    "resources": {},
+    "securityContext": {
+     "allowPrivilegeEscalation": false,
+     "capabilities": {
+      "drop": [
+       "ALL"
+      ]
+     },
+     "privileged": false,
+     "readOnlyRootFilesystem": true
+    },
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/metricbeat-config",
+      "name": "sample-metricbeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/es-monitoring-association/observability/monitoring/certs",
+      "name": "es-monitoring-03f555-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/es-monitoring/aerospace/sample/certs",
+      "name": "es-monitoring-local-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/data",
+      "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
+     }
+    ]
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/filebeat-config/filebeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/filebeat:7.14.0",
+    "name": "filebeat",
+    "resources": {},
+    "securityContext": {
+     "allowPrivilegeEscalation": false,
+     "capabilities": {
+      "drop": [
+       "ALL"
+      ]
+     },
+     "privileged": false,
+     "readOnlyRootFilesystem": true
+    },
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/filebeat-config",
+      "name": "sample-filebeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/es-monitoring-association/observability/monitoring/certs",
+      "name": "es-monitoring-03f555-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/filebeat/data",
+      "name": "filebeat-data"
+     },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
+     {
+      "mountPath": "/usr/share/elasticsearch/logs",
+      "name": "elasticsearch-logs"
+     }
+    ]
+   }
+  ],
+  "volumes": [
+   {
+    "name": "es-monitoring-03f555-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-logs-observability-monitoring-ca"
+    }
+   },
+   {
+    "name": "es-monitoring-local-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-http-certs-public"
+    }
+   },
+   {
+    "emptyDir": {},
+    "name": "filebeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
diff --git a/pkg/controller/elasticsearch/stackmon/sidecar.go b/pkg/controller/elasticsearch/stackmon/sidecar.go
index bae503617..e59a4bf2b 100644
--- a/pkg/controller/elasticsearch/stackmon/sidecar.go
+++ b/pkg/controller/elasticsearch/stackmon/sidecar.go
@@ -13,10 +13,12 @@ import (
 
 	commonv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
 	esv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/elasticsearch/v1"
+	beatstackmon "github.com/elastic/cloud-on-k8s/v3/pkg/controller/beat/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/defaults"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon/monitoring"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/version"
+	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/volume"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/network"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/securitycontext"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/elasticsearch/user"
@@ -104,6 +106,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add metricbeat logs volume
+		metricbeatLogsVolume := volume.NewEmptyDirVolume(beatstackmon.MetricbeatLogsVolumeName, beatstackmon.MetricbeatLogsVolumeMountPath)
+		volumes = append(volumes, metricbeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, metricbeatLogsVolume.VolumeMount())
+
 		volumes = append(volumes, b.Volumes...)
 		builder.WithContainers(b.Container)
 		configHash.Write(b.ConfigHash.Sum(nil))
@@ -118,6 +125,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add filebeat logs volume
+		filebeatLogsVolume := volume.NewEmptyDirVolume(beatstackmon.FilebeatLogsVolumeName, beatstackmon.FilebeatLogsVolumeMountPath)
+		volumes = append(volumes, filebeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, filebeatLogsVolume.VolumeMount())
+
 		volumes = append(volumes, b.Volumes...)
 		filebeat := b.Container
 
diff --git a/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
index ada1ecb81..4afd125e8 100755
--- a/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/kibana/stackmon/__snapshots__/sidecar_test.snap
@@ -97,6 +97,10 @@
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    }
@@ -120,6 +124,10 @@
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-metricbeat-config",
     "secret": {
@@ -215,6 +223,10 @@
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/kibana/logs",
       "name": "kibana-logs"
@@ -227,6 +239,10 @@
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "kb-monitoring-03f555-ca",
     "secret": {
@@ -337,6 +353,10 @@
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -402,6 +422,10 @@
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/kibana/logs",
       "name": "kibana-logs"
@@ -414,6 +438,10 @@
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "kb-monitoring-03f555-ca",
     "secret": {
@@ -436,6 +464,10 @@
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
@@ -542,6 +574,10 @@
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -607,6 +643,10 @@
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/kibana/logs",
       "name": "kibana-logs"
@@ -619,6 +659,10 @@
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "kb-monitoring-03f555-ca",
     "secret": {
@@ -648,6 +692,10 @@
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
@@ -807,3 +855,231 @@ processors:
     - add_host_metadata: null
 
 ---
+
+[TestWithMonitoring/with_metrics_and_logs_monitoring_and_read_only_root_filesystem - 1]
+{
+ "metadata": {
+  "annotations": {
+   "kibana.k8s.elastic.co/monitoring-config-hash": "1902028541"
+  },
+  "creationTimestamp": null
+ },
+ "spec": {
+  "automountServiceAccountToken": false,
+  "containers": [
+   {
+    "name": "kibana",
+    "resources": {},
+    "volumeMounts": [
+     {
+      "mountPath": "/usr/share/kibana/logs",
+      "name": "kibana-logs"
+     }
+    ]
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/metricbeat-config/metricbeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/metricbeat:7.14.0",
+    "name": "metricbeat",
+    "resources": {},
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/metricbeat-config",
+      "name": "sample-metricbeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/kb-monitoring-association/observability/monitoring/certs",
+      "name": "kb-monitoring-03f555-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/kb-monitoring/aerospace/sample/certs",
+      "name": "kb-monitoring-local-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/data",
+      "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
+     }
+    ]
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/filebeat-config/filebeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/filebeat:7.14.0",
+    "name": "filebeat",
+    "resources": {},
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/filebeat-config",
+      "name": "sample-filebeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/kb-monitoring-association/observability/logs/certs",
+      "name": "kb-monitoring-584a4d-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/filebeat/data",
+      "name": "filebeat-data"
+     },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
+     {
+      "mountPath": "/usr/share/kibana/logs",
+      "name": "kibana-logs"
+     }
+    ]
+   }
+  ],
+  "volumes": [
+   {
+    "emptyDir": {},
+    "name": "filebeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
+   {
+    "name": "kb-monitoring-03f555-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-monitoring-observability-monitoring-ca"
+    }
+   },
+   {
+    "name": "kb-monitoring-584a4d-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-logs-observability-monitoring-ca"
+    }
+   },
+   {
+    "name": "kb-monitoring-local-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-kb-http-certs-public"
+    }
+   },
+   {
+    "emptyDir": {},
+    "name": "kibana-logs"
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
+   {
+    "name": "sample-filebeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-kb-monitoring-filebeat-config"
+    }
+   },
+   {
+    "name": "sample-metricbeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-kb-monitoring-metricbeat-config"
+    }
+   }
+  ]
+ }
+}
+---
diff --git a/pkg/controller/kibana/stackmon/sidecar.go b/pkg/controller/kibana/stackmon/sidecar.go
index 0a6e2eb10..76eaaf32f 100644
--- a/pkg/controller/kibana/stackmon/sidecar.go
+++ b/pkg/controller/kibana/stackmon/sidecar.go
@@ -15,6 +15,7 @@ import (
 	commonv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
 	kbv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/kibana/v1"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/association"
+	beatstackmon "github.com/elastic/cloud-on-k8s/v3/pkg/controller/beat/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/defaults"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon/monitoring"
@@ -122,6 +123,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add metricbeat logs volume
+		metricbeatLogsVolume := volume.NewEmptyDirVolume(beatstackmon.MetricbeatLogsVolumeName, beatstackmon.MetricbeatLogsVolumeMountPath)
+		volumes = append(volumes, metricbeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, metricbeatLogsVolume.VolumeMount())
+
 		volumes = append(volumes, b.Volumes...)
 		builder.WithContainers(b.Container)
 		configHash.Write(b.ConfigHash.Sum(nil))
@@ -133,6 +139,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add filebeat logs volume
+		filebeatLogsVolume := volume.NewEmptyDirVolume("filebeat-logs", "/usr/share/filebeat/logs")
+		volumes = append(volumes, filebeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, filebeatLogsVolume.VolumeMount())
+
 		// create a logs volume shared between Kibana and Filebeat
 		logsVolume := volume.NewEmptyDirVolume(kibanaLogsVolumeName, kibanaLogsMountPath)
 		volumes = append(volumes, logsVolume.Volume())
diff --git a/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap b/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
index 4e19816b9..f73305e8f 100755
--- a/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
+++ b/pkg/controller/logstash/stackmon/__snapshots__/sidecar_test.snap
@@ -235,6 +235,10 @@ processors:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    }
@@ -251,6 +255,10 @@ processors:
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-metricbeat-config",
     "secret": {
@@ -344,6 +352,10 @@ processors:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    }
@@ -367,6 +379,10 @@ processors:
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-metricbeat-config",
     "secret": {
@@ -462,6 +478,10 @@ processors:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/logstash/logs",
       "name": "logstash-logs"
@@ -474,6 +494,10 @@ processors:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "ls-monitoring-03f555-ca",
     "secret": {
@@ -575,6 +599,10 @@ processors:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -640,6 +668,10 @@ processors:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/logstash/logs",
       "name": "logstash-logs"
@@ -652,6 +684,10 @@ processors:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "ls-monitoring-03f555-ca",
     "secret": {
@@ -663,6 +699,10 @@ processors:
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
@@ -764,6 +804,10 @@ processors:
      {
       "mountPath": "/usr/share/metricbeat/data",
       "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
      }
     ]
    },
@@ -829,6 +873,10 @@ processors:
       "mountPath": "/usr/share/filebeat/data",
       "name": "filebeat-data"
      },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
      {
       "mountPath": "/usr/share/logstash/logs",
       "name": "logstash-logs"
@@ -841,6 +889,10 @@ processors:
     "emptyDir": {},
     "name": "filebeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
    {
     "name": "ls-monitoring-03f555-ca",
     "secret": {
@@ -859,6 +911,215 @@ processors:
     "emptyDir": {},
     "name": "metricbeat-data"
    },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
+   {
+    "name": "sample-filebeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-ls-monitoring-filebeat-config"
+    }
+   },
+   {
+    "name": "sample-metricbeat-config",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-ls-monitoring-metricbeat-config"
+    }
+   }
+  ]
+ }
+}
+---
+
+[TestWithMonitoring/with_metrics_and_logs_monitoring_with_readonly_root_filesystem - 1]
+{
+ "metadata": {
+  "annotations": {
+   "logstash.k8s.elastic.co/monitoring-config-hash": "808554888"
+  },
+  "creationTimestamp": null
+ },
+ "spec": {
+  "automountServiceAccountToken": false,
+  "containers": [
+   {
+    "env": [
+     {
+      "name": "LOG_STYLE",
+      "value": "file"
+     }
+    ],
+    "name": "logstash",
+    "resources": {}
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/metricbeat-config/metricbeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/metricbeat:8.6.0",
+    "name": "metricbeat",
+    "resources": {},
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/metricbeat-config",
+      "name": "sample-metricbeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/ls-monitoring-association/observability/monitoring/certs",
+      "name": "ls-monitoring-03f555-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/data",
+      "name": "metricbeat-data"
+     },
+     {
+      "mountPath": "/usr/share/metricbeat/logs",
+      "name": "metricbeat-logs"
+     }
+    ]
+   },
+   {
+    "args": [
+     "-c",
+     "/etc/filebeat-config/filebeat.yml",
+     "-e"
+    ],
+    "env": [
+     {
+      "name": "POD_IP",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "status.podIP"
+       }
+      }
+     },
+     {
+      "name": "POD_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.name"
+       }
+      }
+     },
+     {
+      "name": "NODE_NAME",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "spec.nodeName"
+       }
+      }
+     },
+     {
+      "name": "NAMESPACE",
+      "valueFrom": {
+       "fieldRef": {
+        "apiVersion": "v1",
+        "fieldPath": "metadata.namespace"
+       }
+      }
+     }
+    ],
+    "image": "docker.elastic.co/beats/filebeat:8.6.0",
+    "name": "filebeat",
+    "resources": {},
+    "volumeMounts": [
+     {
+      "mountPath": "/etc/filebeat-config",
+      "name": "sample-filebeat-config",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/mnt/elastic-internal/ls-monitoring-association/observability/monitoring/certs",
+      "name": "ls-monitoring-03f555-ca",
+      "readOnly": true
+     },
+     {
+      "mountPath": "/usr/share/filebeat/data",
+      "name": "filebeat-data"
+     },
+     {
+      "mountPath": "/usr/share/filebeat/logs",
+      "name": "filebeat-logs"
+     },
+     {
+      "mountPath": "/usr/share/logstash/logs",
+      "name": "logstash-logs"
+     }
+    ]
+   }
+  ],
+  "volumes": [
+   {
+    "emptyDir": {},
+    "name": "filebeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "filebeat-logs"
+   },
+   {
+    "name": "ls-monitoring-03f555-ca",
+    "secret": {
+     "optional": false,
+     "secretName": "sample-es-logs-observability-monitoring-ca"
+    }
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-data"
+   },
+   {
+    "emptyDir": {},
+    "name": "metricbeat-logs"
+   },
    {
     "name": "sample-filebeat-config",
     "secret": {
diff --git a/pkg/controller/logstash/stackmon/sidecar.go b/pkg/controller/logstash/stackmon/sidecar.go
index 8ba8d39cb..b0c10c035 100644
--- a/pkg/controller/logstash/stackmon/sidecar.go
+++ b/pkg/controller/logstash/stackmon/sidecar.go
@@ -13,10 +13,12 @@ import (
 
 	commonv1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/common/v1"
 	logstashv1alpha1 "github.com/elastic/cloud-on-k8s/v3/pkg/apis/logstash/v1alpha1"
+	beatstackmon "github.com/elastic/cloud-on-k8s/v3/pkg/controller/beat/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/defaults"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/stackmon/monitoring"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/version"
+	commonvolume "github.com/elastic/cloud-on-k8s/v3/pkg/controller/common/volume"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/logstash/configs"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/logstash/network"
 	"github.com/elastic/cloud-on-k8s/v3/pkg/controller/logstash/volume"
@@ -90,6 +92,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add metricbeat logs volume
+		metricbeatLogsVolume := commonvolume.NewEmptyDirVolume(beatstackmon.MetricbeatLogsVolumeName, beatstackmon.MetricbeatLogsVolumeMountPath)
+		volumes = append(volumes, metricbeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, metricbeatLogsVolume.VolumeMount())
+
 		volumes = append(volumes, b.Volumes...)
 		builder.WithContainers(b.Container)
 		configHash.Write(b.ConfigHash.Sum(nil))
@@ -104,6 +111,11 @@ func WithMonitoring(ctx context.Context, client k8s.Client, builder *defaults.Po
 			return nil, err
 		}
 
+		// Add filebeat logs volume
+		filebeatLogsVolume := commonvolume.NewEmptyDirVolume(beatstackmon.FilebeatLogsVolumeName, beatstackmon.FilebeatLogsVolumeMountPath)
+		volumes = append(volumes, filebeatLogsVolume.Volume())
+		b.Container.VolumeMounts = append(b.Container.VolumeMounts, filebeatLogsVolume.VolumeMount())
+
 		filebeat := b.Container
 		// Add the logs volume mount from the logstash container
 		filebeat.VolumeMounts = append(filebeat.VolumeMounts, volume.DefaultLogsVolume.VolumeMount())



Test patch:
diff --git a/pkg/controller/beat/common/stackmon/stackmon_test.go b/pkg/controller/beat/common/stackmon/stackmon_test.go
index 21ad8c263..1cf58ff52 100644
--- a/pkg/controller/beat/common/stackmon/stackmon_test.go
+++ b/pkg/controller/beat/common/stackmon/stackmon_test.go
@@ -85,6 +85,11 @@ func TestMetricBeat(t *testing.T) {
 				ReadOnly:  false,
 				MountPath: "/var/shared",
 			},
+			{
+				Name:      "metricbeat-logs",
+				ReadOnly:  false,
+				MountPath: "/usr/share/metricbeat/logs",
+			},
 		},
 	}
 	beatYml := `http:
@@ -165,6 +170,10 @@ output:
 					Name:         "shared-data",
 					VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
 				},
+				{
+					Name:         "metricbeat-logs",
+					VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
+				},
 			},
 		}
 	}
diff --git a/pkg/controller/logstash/stackmon/sidecar_test.go b/pkg/controller/logstash/stackmon/sidecar_test.go
index 9ad0b2d59..6c5c65d6c 100644
--- a/pkg/controller/logstash/stackmon/sidecar_test.go
+++ b/pkg/controller/logstash/stackmon/sidecar_test.go
@@ -142,6 +142,17 @@ func TestWithMonitoring(t *testing.T) {
 			},
 			apiServerConfig: GetAPIServerWithSSLEnabled(false),
 		},
+		{
+			name: "with metrics and logs monitoring with readonly root filesystem",
+			ls: func() logstashv1alpha1.Logstash {
+				sampleLs.Spec.Monitoring.Metrics.ElasticsearchRefs = monitoringEsRef
+				monitoring.GetMetricsAssociation(&sampleLs)[0].SetAssociationConf(&monitoringAssocConf)
+				sampleLs.Spec.Monitoring.Logs.ElasticsearchRefs = monitoringEsRef
+				monitoring.GetLogsAssociation(&sampleLs)[0].SetAssociationConf(&logsAssocConf)
+				return sampleLs
+			},
+			apiServerConfig: GetAPIServerWithSSLEnabled(false),
+		},
 	}
 
 	for _, tc := range tests {