after various research, I've decided filebeat is probably the option I'll go with for kubernetes centralized logging.
fluentd is probably fine but I'm not too into using ruby for high performance things like this
fluent bit looked good but was much less flexible
filebeat looks like a good balance of resource usage and flexibility