1. Create a new namespace called external-logging that will host the Filebeat Daemonset and Logstash Deployment containers: 

kubectl create namespace external-logging 

2. Create a new namespace called external  that will host the containers to generate logs for this example: 

kubectl create namespace external 

3. Copy the required Secret and ConfigMaps to the external-logging  namespace. Note that doing this provides any users with access to this namespace the ability to view the authentication certificates for the platform ELK. In this example, only the required certificates are extracted from the logging-elk-certs in kube-system. 

a. Copy the required files from the logging-elk-certs  Secret 

i. Copy the logging-elk-certs  Secret: 

kubectl -n kube-system get secret logging-elk-certs -o yaml | sed "s/namespace: kube-system/namespace: external-logging/g" | kubectl -n external-logging create -f - 

ii. Remove all entries in data except  for the following, using kubectl -n external-logging edit secret logging-elk-certs: 

- ca.crt 

- logstash.crt 

- logstash.key 

- filebeat.crt 

- filebeat.key 

b. Copy the logging-elk-elasticsearch-pki-secret  Secret to the external-logging namespace: 

kubectl -n kube-system get secret logging-elk-elasticsearch-pki-secret -o yaml | sed "s/namespace: kube-system/namespace: external-logging/g" | kubectl -n external-logging create -f - 

c. Copy the logging-elk-elasticsearch-entrypoint  ConfigMap: 

kubectl -n kube-system get configmap logging-elk-elasticsearch-entrypoint -o yaml | sed "s/namespace: kube-system/namespace: external-logging/g" | kubectl -n external-logging create -f - 

4. Create a RoleBinding to the ibm-anyuid-hostaccess-clusterrole  so that the Logstash pod can use the host network to reach the external Elasticsearch: 

kubectl -n external-logging create rolebinding ibm-anyuid-hostaccess-rolebinding --clusterrole ibm-anyuid-hostaccess-clusterrole --serviceaccount=external-logging:default 

Tip:  This step is not needed if Logstash is being deployed to kube-system  namespace, as it automatically inherits this privilege from the ibm-privileged-psp  Pod Security Policy. 

5. Create the filebeat-config.yaml  in Example 5-28. 

apiVersion: v1 kind: ConfigMap metadata: labels: app: filebeat-ds 

