# Filebeat to ECK on GKE

**URL:** <https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [January 18, 2020, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575 "2020-01-18T20:58:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zero\_Day](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zero_day/32/50435_2.png) [@Zero\_Day](https://discuss.elastic.co/u/Zero_Day)\
**Post date:** [January 18, 2020, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575/1 "2020-01-18T20:58:05Z")

</div>

I built a cluster on GKE with ECK operator and am trying to send logs from an on premises Filebeat installation to the cloud.

Elasticsearch has LoadBlancer IP. I specified certificate, password and necessary things, but I couldn't make it work. Is there a tutorial?

---

<div class="post-metadata">

**Author:** ![dkow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dkow/32/47340_2.png) [@dkow](https://discuss.elastic.co/u/dkow)\
**Post date:** [January 20, 2020, 5:47am UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575/2 "2020-01-20T05:47:51Z")

</div>

Hi @Zero_Day, thanks for your message.

While not reflecting an exactly same setup, we have a sample that contains filebeat configuration - [https://github.com/elastic/cloud-on-k8s/blob/master/config/recipes/beats/2\_filebeat-kubernetes.yaml](https://github.com/elastic/cloud-on-k8s/blob/master/config/recipes/beats/2_filebeat-kubernetes.yaml).

Are there any specific errors, logs, configs, that you could share? Is the Elasticsearch reachable (e.g. with curl) from the host running filebeat through that LoadBalancerIP?

---

<div class="post-metadata">

**Author:** ![Zero\_Day](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zero_day/32/50435_2.png) [@Zero\_Day](https://discuss.elastic.co/u/Zero_Day)\
**Post date:** [January 20, 2020, 7:43am UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575/3 "2020-01-20T07:43:18Z")

</div>

Hi,

First of all thanks for the quick reply. Error I am getting related to x509 cert. I got the cert from elasticsearch-ca-internal. Still same error.

---

<div class="post-metadata">

**Author:** ![dkow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dkow/32/47340_2.png) [@dkow](https://discuss.elastic.co/u/dkow)\
**Post date:** [January 20, 2020, 10:03am UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575/4 "2020-01-20T10:03:58Z")

</div>

I think the issue you are hitting is related to SANs on the certificate. Currently, we don't populate the generated certificate with LoadBalancer IP as IP SAN. This means that when you use IP address to connect to ES, TLS connection can't be established due to that IP not being present on the cert.

To resolve it right now, you can change your ES spec to include the following:

```auto
spec:
...
  http:
    service:
      spec:
        type: LoadBalancer
    tls:
      selfSignedCertificate:
        subjectAltNames:
        - ip: IP_ADDRESS

```

where IP\_ADDRESS is the external (LoadBalancer) IP that you are using to connect to ES.

Enhancement that would make this seamless (ie. would not require the `tls` config section to be added by the user) is tracked at [https://github.com/elastic/cloud-on-k8s/issues/910](https://github.com/elastic/cloud-on-k8s/issues/910).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:41am UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575/5 "2022-11-04T07:41:12Z")

</div>