# Kubernetes filebeat not sending logs to secured Elasticsearch
**URL:** https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334
**Category:** Beats
**Tags:** docker, filebeat, metricbeat
**Created:** [November 18, 2022, 9:28pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334 "2022-11-18T21:28:01Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [November 18, 2022, 9:28pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/1 "2022-11-18T21:28:01Z")
Hello Team
We are facing an issue where we have setup the filebeat on kubernetes environment it is working well if we setup the output without https but while setting the output as secured elasticsearch node i.e. [https://elastichost:9200](https://elastichost:9200) it doesnt go, followed below link to setup filebeat
([Run Filebeat on Kubernetes | Filebeat Reference [master] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html#_kubernetes_deploy_manifests))
follwoing are the configuration from filebeat-kubernetes.yaml file
```auto
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: kube-system
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.inputs:
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"
processors:
- add_cloud_metadata:
- add_host_metadata:
cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:XX.XX.XX.XX}:${ELASTICSEARCH_PORT:9200}']
username: ${ELASTICSEARCH_USERNAME}
password: ${ELASTICSEARCH_PASSWORD}
ssl.certificate_authorities: ["/etc/ssl/certs/ca.crt"]
ssl_verify: true
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: filebeat
namespace: kube-system
labels:
k8s-app: filebeat
spec:
selector:
matchLabels:
k8s-app: filebeat
template:
metadata:
labels:
k8s-app: filebeat
spec:
serviceAccountName: filebeat
terminationGracePeriodSeconds: 30
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
containers:
- name: filebeat
image: docker.elastic.co/beats/filebeat:8.4.3
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
env:
- name: ELASTICSEARCH_HOST
value: https://XX.XX.XX.XX
- name: ELASTICSEARCH_PORT
value: "9200"
- name: ELASTICSEARCH_USERNAME
value: elastic
- name: ELASTICSEARCH_PASSWORD
value: elastic
- name: ELASTICSEARCH_SCHEME
value: "https"
- name: ELASTICSEARCH_SSL_VERIFY
value: "true"
```
Regards
Pratiksha
---
### Author:  [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)
#### Post date: [November 19, 2022, 4:41pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/2 "2022-11-19T16:41:27Z")
Hi
I thing you should mount your public key in your pod as a local storage then provide a link to the key in filebet DaemonSet.
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [November 21, 2022, 4:36pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/3 "2022-11-21T16:36:30Z")
Hi @Ehsan_Orve
Thank you for revert i am not able to get the configuration procedure as you advised,if possible could you please help with steps how i can achieve it in my kubernetes setup
kubernetes version 1.21
Also do you fidn any issue issue my ssl configuration from above configuration
Regards
Pratiksha
---
### Author:  [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)
#### Post date: [November 21, 2022, 6:32pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/4 "2022-11-21T18:32:03Z")
I am sorry i tought you have used elastic agent. It is better and also easier to use Fleet and elastic agent to gathering and monitoring k&s pods.
about ssl did you use elasticsearch-certutil to generate a ssl? If yes, you should address elasticseach-ca.pem file (If I can remember correctly) in filebeat config file.
can u access to elasticsearch on port 9200 securly in a web browser?
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [November 22, 2022, 12:18pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/5 "2022-11-22T12:18:05Z")
Hello @Ehsan_Orve
i am using filebeat-kubernetes.yanl file where i did not get the option to add certificate information
step1
curl -L -O [https://raw.githubusercontent.com/elastic/beats/8.4/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/8.4/deploy/kubernetes/filebeat-kubernetes.yaml)
step2
after downloading file i editing the yaml file stored at path c:/code
NOTE: without SSL
step3
kubectl create -f filebeat-kubernetes.yaml
step4
kubectl apply -f filebeat-kubernetes.yaml
i am following above to setup filebeat on kubernetes cluster
Yes i generated the ssl certificate using elastic-cert utility
i do not get the right option in filebeat-kubernetes.yaml to configure ssl information
Yes i can access elasticsearch on port 9200 in web browser
Regards
Pratiksha
---
### Author:  [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)
#### Post date: [November 22, 2022, 1:23pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/6 "2022-11-22T13:23:51Z")
Hi @pratikshatiwari
I think u should use VolumeMount and VolumePath in Daemonset under spec--\>containers section:
In this way you will attach crt file into the filebeat container then use mount it in "/etc/ssl/certs/ca.crt" so filebeat can use it. Maybe it seems a little difficult to put this lines in your DaemonSet file, but you can do it.
```auto
volumeMounts:
- name: cert-file
mountPath: /etc/ssl/certs/ca.crt
readOnly: true
volumes:
- name: cert-file
hostPath:
path: "Path of crt file on your kubernetes node"
```
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [November 24, 2022, 3:38pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/7 "2022-11-24T15:38:25Z")
Hello @Ehsan_Orve
Thank you for sharing the configuration, however i have started getting the configuration error
Am i doing anything wrong here?
Following configuration i made
spec:
serviceAccountName: filebeat
terminationGracePeriodSeconds: 30
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
containers:
- name: filebeat
image: [docker.elastic.co/beats/filebeat:8.4.3](http://docker.elastic.co/beats/filebeat:8.4.3)
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
volumeMounts:
- name: cert-file
mountPath: /etc/ssl/certs/ca.crt
readOnly: true
volumes:
- name: cert-file
hostPath:
path: "/etc/ssl/certs/ca.crt"
Error detail as below:
serviceaccount/filebeat unchanged
The request is invalid: patch: Invalid value: "map[metadata:map[annotations:map[[kubectl.kubernetes.io/last-applied-configuration:](http://kubectl.kubernetes.io/last-applied-configuration:){"apiVersion":"apps/v1","kind":"DaemonSet","metadata":{"annotations":{},"labels":{"k8s-app":"filebeat"},"name":"filebeat","namespace":"kube-system"},"spec":{"selector":{"matchLabels":{"k8s-app":"filebeat"}},"template":{"metadata":{"labels":{"k8s-app":"filebeat"}},"spec":{"containers":[{"args":["-c","/etc/filebeat.yml","-e"],"env":[{"name":"ELASTICSEARCH\_HOST","value":"[https://35.223.228.215](https://35.223.228.215)"},{"name":"ELASTICSEARCH\_PORT","value":"9200"},{"name":"ELASTICSEARCH\_USERNAME","value":"elastic"},{"name":"ELASTICSEARCH\_PASSWORD","value":"elastic"},{"name":"ELASTICSEARCH\_SCHEME","value":"https"},{"name":"ELASTICSEARCH\_SSL\_VERIFY","value":"true"},{"name":"NODE\_NAME","valueFrom":{"fieldRef":{"fieldPath":"spec.nodeName"}}}],"image":"docker.elastic.co/beats/filebeat:8.4.3","name":"filebeat","resources":{"limits":{"memory":"200Mi"},"requests":{"cpu":"100m","memory":"100Mi"}},"securityContext":{"runAsUser":0},"volumeMounts":[{"mountPath":"/etc/filebeat.yml","name":"config","readOnly":true,"subPath":"filebeat.yml"},{"mountPath":"/usr/share/filebeat/data","name":"data"},{"mountPath":"/var/lib/docker/containers","name":"varlibdockercontainers","readOnly":true},{"mountPath":"/var/log","name":"varlog","readOnly":true}],"volumes":[{"hostPath":{"path":"/etc/ssl/certs/ca.crt"},"name":"cert-file"}]}],"dnsPolicy":"ClusterFirstWithHostNet","hostNetwork":true,"serviceAccountName":"filebeat","terminationGracePeriodSeconds":30,"volumes":[{"configMap":{"defaultMode":416,"name":"filebeat-config"},"name":"config"},{"hostPath":{"path":"/var/lib/docker/containers"},"name":"varlibdockercontainers"},{"hostPath":{"path":"/var/log"},"name":"varlog"},{"hostPath":{"path":"/var/lib/filebeat-data","type":"DirectoryOrCreate"},"name":"data"}]}}}}\n]] spec:map[template:map[spec:map]]]": strict decoding error: unknown field "spec.template.spec.containers[0].volumes"
Regards
Pratiksha
---
### Author:  [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)
#### Post date: [November 25, 2022, 6:39pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/8 "2022-11-25T18:39:53Z")
Could u copy all daemonSet here?
---
### Author:  [@Ehsan\_Orve](https://discuss.elastic.co/u/Ehsan_Orve)
#### Post date: [November 25, 2022, 6:53pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/9 "2022-11-25T18:53:46Z")
And also read this:
> [@Filebeat running on Kubernetes connected to Elasticsearch using SSL](https://discuss.elastic.co/t/filebeat-running-on-kubernetes-connected-to-elasticsearch-using-ssl/279946):
>
> I would like to use filebeat on Kubernetes and connect it to a secured Elasticsearch server, using certificates. I did a search to find how to do this but only found an un-answered related question. After some test I got it, so I will share my findings to help anybody else. These are the steps: Follow the original [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html) to download the yaml file. As shown on the documentation, update this file with the correct details about the Elasticsearch server: hostname, port, user and passw…
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2022, 8:54pm UTC](https://discuss.elastic.co/t/kubernetes-filebeat-not-sending-logs-to-secured-elasticsearch/319334/10 "2022-12-23T20:54:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.