<p>I am trying to collect the logs from kubernetes pods and pass it to elastic db using logstash and filebeats.I am able to deploy the Elasticsearch and kibana in k8 cluster but i am not able to deploy my logstash and filebeat.</p>
<p>My elastisearch.yaml file is</p>
<pre><code>apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
name: elasticsearch
spec:
version: 7.14.1 #Make sure you use the version of your choice
http:
service:
spec:
type: LoadBalancer #Adds a External IP
nodeSets:

name: default
count: 1
config:
node.store.allow_mmap: false
</code></pre>
<p>Logstash.yaml file is</p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
name: logstash-configmap
data:
logstash.yml: |
http.host: &quot;0.0.0.0&quot;
path.config: /usr/share/logstash/pipeline
logstash.conf: |
input {
beats {
port =&gt; 5044
}
}
output {
elasticsearch {
hosts =&gt; &quot;https://External ip:9200&quot;
index =&gt;&quot;testlogs&quot;
user =&gt; &quot;elastic&quot;
password =&gt; &quot;xxxx&quot;
cacert =&gt; &quot;/etc/&quot;
ssl_certificate_verification =&gt; false
}
}
apiVersion: apps/v1
kind: Deployment
metadata:
name: logstash-deployment
spec:
replicas: 1
selector:
matchLabels:
app: logstash
template:
metadata:
labels:
app: logstash
spec:
containers:
- name: logstash
image: docker.elastic.co/logstash/logstash:7.14.1
ports:
- containerPort: 5044
volumeMounts:
- name: config-volume
mountPath: /usr/share/logstash/config
- name: logstash-pipeline-volume
mountPath: /usr/share/logstash/pipeline
volumes:
- name: config-volume
configMap:
name: logstash-configmap
items:
- key: logstash.yml
path: logstash.yml
- name: logstash-pipeline-volume
configMap:
name: logstash-configmap
items:
- key: logstash.conf
path: logstash.conf
kind: Service
apiVersion: v1
metadata:
name: logstash-service
spec:
selector:
app: logstash
ports:
- protocol: TCP
port: 5044
targetPort: 5044
</code></pre>
<p>After deploying my logstash pods got crashed and getting this error</p>
<pre><code>[ERROR] 2022-10-21 08:54:16.937 [[main]-pipeline-manager] javapipeline - Pipeline error {:pipeline_id=&gt;&quot;main&quot;, :exception=&gt;#&lt;Errno::EISDIR: Is a directory - channel: org.jruby.util.io.ChannelFD@2f88e4ba /etc/&gt;, :backtrace=&gt;[&quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:642:in block in setup_trust_store'&quot;, &quot;org/jruby/RubyIO.java:1158:in open'&quot;, &quot;org/jruby/RubyKernel.java:317:in open'&quot;, &quot;uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/open-uri.rb:37:in open'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:641:in setup_trust_store'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:629:in ssl_socket_factory_from_options'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:396:in pool_builder'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:404:in pool'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/client.rb:207:in initialize'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:26:in initialize'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:319:in build_adapter'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:323:in build_pool'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client.rb:62:in initialize'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:106:in create_http_client'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:102:in build'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:34:in build_client'&quot;, &quot;/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.3-java/lib/logstash/outputs/elasticsearch.rb:275:in register'&quot;, &quot;org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in register'&quot;, &quot;org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in register'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in block in register_plugins'&quot;, &quot;org/jruby/RubyArray.java:1820:in each'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in register_plugins'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:585:in maybe_setup_out_plugins'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in start_workers'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in run'&quot;, &quot;/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in block in start'&quot;], &quot;pipeline.sources&quot;=&gt;[&quot;/usr/share/logstash/pipeline/logstash.conf&quot;], :thread=&gt;&quot;#&lt;Thread:0x5b2f9d8f@/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:125 run&gt;&quot;}
[INFO ] 2022-10-21 08:54:16.940 [[main]-pipeline-manager] javapipeline - Pipeline terminated {&quot;pipeline.id&quot;=&gt;&quot;main&quot;}
[ERROR] 2022-10-21 08:54:16.957 [Converge PipelineAction::Create] agent - Failed to execute action {:id=&gt;:main, :action_type=&gt;LogStash::ConvergeResult::FailedAction, :message=&gt;&quot;Could not execute action: PipelineAction::Create, action_result: false&quot;, :backtrace=&gt;nil}
</code></pre>
<p>Is it because of the ca certificate path which i have mentioned?If so can someone share the correct way to mention the ca certificate and where do i find it in k8 cluster. Thanks in Advance!!</p>

psp
<p>If you check the <a href="https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-cacert" rel="nofollow noreferrer">documentation of the Elasticsearch Output Plugin of Logstash</a>, ca_cert is expected to be a valid file on the file_system not a directory.</p>
<p>You are currently using ECK to manage Elasticsearch and Kibana. ECK creates for you several kubernetes secrets including the certificate_authority of Elasticsearch.</p>
<p>You can get a list of secret with the command <code>kubectl get secret</code> and search for a secret named after your Elasticsearch Cluster name (i.e., <code>elasticsearch</code>) and with the suffix &quot;-remote-ca&quot;, in your case it should be <code>elasticsearch-remote-ca</code>.</p>
<p>You can check the content of the secret with <code>kubectl get secret elasticsearch-remote-ca -o json</code>. You are interested in the json path <code>data &gt; ca.crt</code>. This string is base64 encoded, thus to obtain a valid certificate you should decode it.</p>
<p>Fortunately, kubectl supports also <a href="https://pkg.go.dev/text/template#pkg-overview" rel="nofollow noreferrer">go-template</a> as an output format, which allow us to write this one liner command to extract the key .data.ca.crt and decode it without external dependencies:</p>
<pre><code>kubectl get secret tiny-es-remote-ca -o go-template='{{index .data &quot;ca.crt&quot; | base64decode}}'
</code></pre>
<p>This will output a valid ca certificate something like:</p>
<pre><code>-----BEGIN CERTIFICATE-----
MIIDOzCCA....
-----END CERTIFICATE-----
</code></pre>
<p>We can now copy the certificate into a file named ca.pem.</p>
<p>Now, we can mount this file in the pod and use it in the configuration.</p>
