apiVersion: v1
    kind: ConfigMap
    metadata:
      name: rsyslog-config
      labels:
        version: v1
    data:
      nsx-ncp.conf: |
        module(load="imfile")
    
        ruleset(name="remote") {
          if $msg contains 'nsx-container' then
            action(type="omfwd"
            Protocol="tcp"
            Target="nsx.example.com"
            Port="514")
      
            stop
          }
      
          input(type="imfile"
            File="/var/log/containers/nsx-node-agent-*.log"
            Tag="nsx-node-agent"
            Ruleset="remote")
      
          input(type="imfile"
            File="/var/log/containers/nsx-ncp-*.log"
            Tag="nsx-ncp"
            Ruleset="remote")
      
          input(type="imfile"
            File="/var/log/syslog"
            Tag="nsx-cni"
            Ruleset="remote")
    ---
    # rsyslog DaemonSet
    apiVersion: extensions/v1beta1
    kind: DaemonSet
    metadata:
      name: rsyslog
      labels:
        component: rsyslog
        version: v1
    spec:
      template:
        metadata:
          labels:
          component: rsyslog
          version: v1
    spec:
      hostNetwork: true
      containers:
      - name: rsyslog
        image: example/rsyslog
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: rsyslog-config-volume
          mountPath: /etc/rsyslog.d
        - name: log-volume
          mountPath: /var/log
        - name: container-volume
          mountPath: /var/lib/docker/containers
      volumes:
      - name: rsyslog-config-volume
        configMap:
        name: rsyslog-config
      - name: log-volume
        hostPath:
          path: /var/log
      - name: container-volume
        hostPath:
          path: /var/lib/docker/containers

kubectl apply -f <daemonset yaml file>