You have to exclude the transport port (port 9300) from being proxied. Currently ECK does not support switching off X-Pack security and TLS for the Elasticsearch transport port. If Istio is allowed to proxy the transport port, the traffic is encrypted twice and communication between Elasticsearch nodes is disrupted.
See the documentation: Istio | Elastic Cloud on Kubernetes [1.5] | Elastic.
Check the recipes directory in the ECK source repository for a complete example.