<p>We use AWS Elasticsearch Service. We would like to install fluentd to our Kubernetes cluster. Fluentd sends logs to AWS Elasticsearch Service. It there any instructions on how to do it? At this link, <a href="https://docs.fluentd.org/v/0.12/articles/kubernetes-fluentd" rel="nofollow noreferrer">https://docs.fluentd.org/v/0.12/articles/kubernetes-fluentd</a>, it shows steps on sending the logs to an Elasticsearch Pod. It means the elasticsearch is installed inside the Kubernetes cluster.</p>
<p>The link above shows make changes in fluentd-daemonset-elasticsearch.yaml (see below) for elasticsearch pod. What configuration changes I need to make for the AWS elasticsearch service?</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
  ...
spec:
    ...
    spec:
      containers:
      - name: fluentd
        image: quay.io/fluent/fluentd-kubernetes-daemonset
        env:
          - name:  FLUENT_ELASTICSEARCH_HOST
            value: &quot;elasticsearch-logging&quot;
          - name:  FLUENT_ELASTICSEARCH_PORT
            value: &quot;9200&quot;
            ......
</code></pre>

<p>Assuming that you have the required connectivity. For example, Kubernetes and Elasticsearch on the same <a href="https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html" rel="nofollow noreferrer">VPC</a> or if in different VPCs you have <a href="https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html" rel="nofollow noreferrer">VPC peering</a> configured.</p>
<p>Additionally, you have the firewall rules (<a href="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" rel="nofollow noreferrer">Security Groups</a>) to allow port <code>9200</code> from Kubernetes to the Elasticsearch cluster.</p>
<p>It should be straight forward (just point the configs to the AWS Elasticsearch cluster endpoint):</p>
<pre class="lang-sh prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
  ...
spec:
    ...
    spec:
      containers:
      - name: fluentd
        image: quay.io/fluent/fluentd-kubernetes-daemonset
        env:
          - name:  FLUENT_ELASTICSEARCH_HOST
            value: &quot;vpc-domain-name-identifier.region.es.amazonaws.com&quot; 👈
          - name:  FLUENT_ELASTICSEARCH_PORT
            value: &quot;9200&quot;
            ......

</code></pre>
<p>This is if you are using VPCs. You can also use the public Elasticsearch endpoint too if you configured your cluster that way. (But it's less secure since you are going through the public cloud). Something like this:</p>
<pre class="lang-sh prettyprint-override"><code>https://search-domain-name-identifier.region.es.amazonaws.com
</code></pre>
<p>✌️</p>
