# ECK how to change filebeat and metricbeat image paths?

**URL:** <https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Tags:** docker\
**Created:** [December 2, 2025, 4:33pm UTC](https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817 "2025-12-02T16:33:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Houser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_houser/32/72517_2.png) [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\
**Post date:** [December 2, 2025, 4:33pm UTC](https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817/1 "2025-12-02T16:33:27Z")

</div>

How can I specify a custom path in our private registry for filebeat and metricbeat images?  
Note, these are the images that are used when Elastic pod is deployed, it seems that filebeat and metricbeat containers are needed as well. I cant seem to figure out where I can specify their custom paths for the Elastic deployment.

I tried to add `spec.nodeSets[name].podTemplate.spec.containers[filebeat].image` and ``spec.nodeSets[name].podTemplate.spec.containers[metricbeat].image` but it seems that the eck-operator ignores that.

How can I specify custom paths for these images?

---

<div class="post-metadata">

**Author:** ![Dave\_Houser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_houser/32/72517_2.png) [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\
**Post date:** [December 3, 2025, 2:12pm UTC](https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817/2 "2025-12-03T14:12:12Z")

</div>

Can someone please help with this? I made a issue post on the `cloud-on-k8s` github as well. This is related to the sidecar filebeat and metricbeat images.  
[How to change the Elastic filebeat/metricbeat sidecar container image paths? · Issue #8938 · elastic/cloud-on-k8s](https://github.com/elastic/cloud-on-k8s/issues/8938)

---

<div class="post-metadata">

**Author:** ![Dave\_Houser](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_houser/32/72517_2.png) [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\
**Post date:** [December 3, 2025, 2:45pm UTC](https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817/3 "2025-12-03T14:45:44Z")

</div>

Posted an update to the github issue. Its not possible to change these paths, the eck-oprator prefixes `eck-operator.containerRepository` to every single image path, its hard coded to do that.  
Only work around is you need to put ALL your images under one repository and use that path.

---

<div class="post-metadata">

**Author:** ![pebrc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pebrc/32/101790_2.png) [@pebrc](https://discuss.elastic.co/u/pebrc)\
**Post date:** [December 3, 2025, 3:33pm UTC](https://discuss.elastic.co/t/eck-how-to-change-filebeat-and-metricbeat-image-paths/383817/4 "2025-12-03T15:33:52Z")

</div>

I don’t think this is accurate. You have multiple options to override the images in use:

1. you can set the global `—container-registry` flag in the operator to point to your own registry. As you observed correctly your own registry has then to follow the layout of Elastic’s registry
2. you can set the global `—container-repository` this means all your images have to live in the same repository
3. you can manually override every single image in use through the podTemplate

```auto
eck-elasticsearch:
  enabled: true
  
  # Name of the Elasticsearch resource
  fullnameOverride: elasticsearch
  
  # Version of Elasticsearch
  version: 9.2.0
  
  # Stack monitoring configuration
  # Sends both metrics and logs to the monitoring cluster
  monitoring:
    metrics:
      elasticsearchRefs:
      - name: monitoring
        namespace: observability
    logs:
      elasticsearchRefs:
      - name: monitoring
        namespace: observability
  
  # Node configuration
  nodeSets:
  - name: default
    count: 3
    config:
      # Comment out when setting vm.max_map_count via initContainer
      # For production workloads, it is strongly recommended to increase
      # the kernel setting vm.max_map_count to 262144 and leave this unset
      node.store.allow_mmap: false
    
    
    # Pod template configuration
    podTemplate:
      spec:
        containers:
        # Override the filebeat sidecar container image for log monitoring
        # The container name must match "filebeat" to override the logs monitoring sidecar
        - name: filebeat
          image: my-custom/repo/filebeat:9.2.1 

```

Related documentation: [Running ECK in air-gapped environments | Elastic Docs](https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/air-gapped-install)