{"id":9746,"date":"2026-03-11T17:45:30","date_gmt":"2026-03-11T12:15:30","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=9746"},"modified":"2026-03-11T17:46:22","modified_gmt":"2026-03-11T12:16:22","slug":"kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/","title":{"rendered":"Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>In modern containerized environments, <strong>centralized logging<\/strong> is essential for monitoring, troubleshooting, and maintaining application reliability. Kubernetes workloads generate logs across multiple pods and nodes, which makes log management challenging if logs remain distributed.<\/p>\n\n\n\n<p>To solve this, organizations often use the <strong>ELK Stack (Elasticsearch, Logstash, and Kibana)<\/strong> for centralized logging and observability.<\/p>\n\n\n\n<p>In this guide, we will configure <strong>Filebeat as a DaemonSet in Kubernetes<\/strong> to collect container logs from every node and forward them to an <strong>external Logstash server<\/strong>. Logstash processes these logs and stores them in <strong>Elasticsearch<\/strong>, while <strong>Kibana<\/strong> provides a powerful interface to search, analyze, and visualize logs.<\/p>\n\n\n\n<p>By the end of this setup, Kubernetes logs will be centralised and searchable through Kibana.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"#architecture\"><\/a>Architecture<\/h2>\n\n\n\n<p>Kubernetes Pods<br>             \u2193<br>Filebeat (DaemonSet)<br>             \u2193<br>Logstash (ELK Server)<br>             \u2193<br>     Elasticsearch<br>             \u2193<br>        Kibana<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Filebeat<\/strong> collects logs from Kubernetes nodes.<\/li>\n\n\n\n<li><strong>Logstash<\/strong> processes and formats logs.<\/li>\n\n\n\n<li><strong>Elasticsearch<\/strong> stores logs as searchable indices.<\/li>\n\n\n\n<li><strong>Kibana<\/strong> provides visualisation and search capabilities.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">File Structure (Kubernetes)<\/h2>\n\n\n\n<p>filebeat\/<br>\u251c\u2500\u2500 filebeat.yaml<br>\u251c\u2500\u2500 filebeat-config.yaml<br>\u251c\u2500\u2500 filebeat-daemonset.yaml<br>\u251c\u2500\u2500 filebeat-clusterrole.yaml<br>\u251c\u2500\u2500 filebeat-clusterrolebinding.yaml<br>\u2514\u2500\u2500 filebeat-serviceaccount.yaml<\/p>\n\n\n\n<p>Each file is responsible for configuring Filebeat permissions, configuration, and deployment in Kubernetes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step-by-Step Installation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Create Namespace<\/strong><\/h3>\n\n\n\n<p>First, create a dedicated namespace for monitoring components.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code><code>kubectl create namespace monitoring<\/code><\/code><\/code><\/pre>\n\n\n\n<p>Verify the namespace:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>kubectl get ns<\/code><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Apply Filebeat YAML Files<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl apply -f filebeat-serviceaccount.yaml -n monitoring\nkubectl apply -f filebeat-clusterrole.yaml\nkubectl apply -f filebeat-clusterrolebinding.yaml\nkubectl apply -f filebeat-config.yaml -n monitoring\nkubectl apply -f filebeat-daemonset.yaml -n monitoring<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1025\" height=\"18\" data-id=\"9830\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png\" alt=\"\" class=\"wp-image-9830\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png 1025w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218-300x5.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218-768x13.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218-850x15.png 850w\" sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><\/a><\/figure>\n<\/figure>\n\n\n\n<p>Verify the namespace:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>kubectl get pods -n monitoring<\/code><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112325.png\"><img loading=\"lazy\" decoding=\"async\" width=\"472\" height=\"83\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112325.png\" alt=\"\" class=\"wp-image-9831\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112325.png 472w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112325-300x53.png 300w\" sizes=\"auto, (max-width: 472px) 100vw, 472px\" \/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Verify Filebeat Configuration<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><code>kubectl exec -n monitoring &lt;filebeat-pod-name&gt; -- cat \/usr\/share\/filebeat\/filebeat.yml<\/code><\/code><\/pre>\n\n\n\n<p>Example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>output.logstash:<br>hosts: &#091;\":5046\"]<\/code><\/pre>\n\n\n\n<p>This confirms that Filebeat will forward logs to the <strong>external Logstash server<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Configure Logstash on ELK Server<\/h3>\n\n\n\n<p>On the ELK server, create a Logstash pipeline configuration.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/etc\/logstash\/conf.d\nvi kubernetes.conf<\/code><\/pre>\n\n\n\n<p>Example Logstash configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>input {\n  beats {\n    port =&gt; 5046\n  }\n}\n\nfilter {\n  if &#091;kubernetes]&#091;container]&#091;name] {\n    mutate {\n      add_field =&gt; {\n        \"index_name\" =&gt; \"k8s-%{&#091;kubernetes]&#091;container]&#091;name]}-%{+YYYY.MM.dd}\"\n      }\n    }\n  }\n}\n\noutput {\n  elasticsearch {\n    hosts =&gt; &#091;\"http:\/\/localhost:9200\"]\n    index =&gt; \"%{index_name}\"\n  }\n}<\/code><\/pre>\n\n\n\n<p>This configuration:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Accepts logs from <strong>Filebeat<\/strong><\/li>\n\n\n\n<li>Adds a dynamic <strong>index name based on container name<\/strong><\/li>\n\n\n\n<li>Stores logs in <strong>Elasticsearch<\/strong><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5. Restart Logstash<\/h3>\n\n\n\n<p>After updating the configuration, restart Logstash.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart logstash<\/code><\/pre>\n\n\n\n<p>Check service status:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status logstash<\/code><\/pre>\n\n\n\n<p>Monitor logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tail -f \/var\/log\/logstash\/logstash-plain.log<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">6. Verify Indices in Elasticsearch<\/h3>\n\n\n\n<p>Confirm that Elasticsearch is receiving logs.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -X GET \"localhost:9200\/_cat\/indices?v\"<\/code><\/pre>\n\n\n\n<p>Expected indices:<\/p>\n\n\n\n<p>k8s-myapp-app-YYYY.MM.dd<br>k8s-myapp-app-YYYY.MM.dd<\/p>\n\n\n\n<p>These indices represent logs from Kubernetes containers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Kibana \u2013 Index Management<\/h3>\n\n\n\n<p>Login to <strong>Kibana<\/strong>.<\/p>\n\n\n\n<p>Navigate to:<\/p>\n\n\n\n<p><strong>Stack Management \u2192 Index Management<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"454\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934-1024x454.png\" alt=\"\" class=\"wp-image-9822\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934-1024x454.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934-300x133.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934-768x340.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934-677x300.png 677w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-104934.png 1309w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"474\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237-1024x474.png\" alt=\"\" class=\"wp-image-9823\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237-1024x474.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237-300x139.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237-768x355.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237-648x300.png 648w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-105237.png 1331w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Verify that Kubernetes application indices are visible<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8 Create Index Pattern in Kibana<\/h3>\n\n\n\n<p>To view logs in Kibana, create an index pattern.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Stack Management \u2192 Index Patterns<\/strong><\/li>\n\n\n\n<li>Click <strong>Create index pattern<\/strong><\/li>\n\n\n\n<li>Enter the pattern:<br>  k8s-*<\/li>\n\n\n\n<li>Select time field:<br>@timestamp<\/li>\n\n\n\n<li>Click <strong>Save<\/strong><\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111400-1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"187\" height=\"179\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111400-1.png\" alt=\"\" class=\"wp-image-9825\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111425.png\"><img loading=\"lazy\" decoding=\"async\" width=\"443\" height=\"142\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111425.png\" alt=\"\" class=\"wp-image-9826\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111425.png 443w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111425-300x96.png 300w\" sizes=\"auto, (max-width: 443px) 100vw, 443px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111502.png\"><img loading=\"lazy\" decoding=\"async\" width=\"499\" height=\"550\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111502.png\" alt=\"\" class=\"wp-image-9827\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111502.png 499w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111502-272x300.png 272w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">9 Verify Logs<\/h3>\n\n\n\n<p>Go to <strong>Discover<\/strong> in Kibana.<\/p>\n\n\n\n<p>Select the newly created index pattern.<\/p>\n\n\n\n<p>You can now filter logs by:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Namespace<\/strong><\/li>\n\n\n\n<li><strong>Pod name<\/strong><\/li>\n\n\n\n<li><strong>Container name<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111733.png\"><img loading=\"lazy\" decoding=\"async\" width=\"195\" height=\"321\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111733.png\" alt=\"\" class=\"wp-image-9828\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111733.png 195w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111733-182x300.png 182w\" sizes=\"auto, (max-width: 195px) 100vw, 195px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111848.png\"><img loading=\"lazy\" decoding=\"async\" width=\"343\" height=\"382\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111848.png\" alt=\"\" class=\"wp-image-9829\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111848.png 343w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-111848-269x300.png 269w\" sizes=\"auto, (max-width: 343px) 100vw, 343px\" \/><\/a><\/figure>\n\n\n\n<p>You should now see <strong>Kubernetes application logs flowing into Kibana<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Outcome<\/h3>\n\n\n\n<p>After completing this setup:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kubernetes logs are <strong>centralized<\/strong><\/li>\n\n\n\n<li>Logs are automatically <strong>collected from all nodes<\/strong><\/li>\n\n\n\n<li>Logs are <strong>stored in Elasticsearch<\/strong><\/li>\n\n\n\n<li>Logs are <strong>searchable and visualized in Kibana<\/strong><\/li>\n<\/ul>\n\n\n\n<p>This provides improved observability and faster troubleshooting for Kubernetes workloads.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Important Notes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Filebeat runs as a <strong>DaemonSet<\/strong>, ensuring log collection from every node.<\/li>\n\n\n\n<li>Logstash runs <strong>outside Kubernetes<\/strong> on the ELK server.<\/li>\n\n\n\n<li>Indices are created dynamically using <strong>container name and date<\/strong>.<\/li>\n\n\n\n<li>The setup supports <strong>scalable logging for production Kubernetes clusters<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Conclusion<\/h3>\n\n\n\n<p>Centralized logging is a critical component of operating Kubernetes in production. By integrating <strong>Filebeat, Logstash, Elasticsearch, and Kibana<\/strong>, you can efficiently collect, process, and analyze logs from distributed containers across your cluster.<\/p>\n\n\n\n<p>This architecture ensures that logs are <strong>structured, searchable, and easily accessible<\/strong>, helping DevOps and SRE teams quickly identify issues, debug applications, and monitor system health.<\/p>\n\n\n\n<p>Implementing this logging pipeline not only improves observability but also lays the foundation for advanced monitoring, alerting, and security analysis within your Kubernetes infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction In modern containerized environments, centralized logging is essential for monitoring, troubleshooting, and maintaining application reliability. Kubernetes workloads generate logs across multiple pods and nodes, which makes log management challenging if logs remain distributed. To solve this, organizations often use the ELK Stack (Elasticsearch, Logstash, and Kibana) for centralized logging&hellip; <a href=\"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/\" class=\"more-link read-more\" rel=\"bookmark\">Continue Reading <span class=\"screen-reader-text\">Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)<\/span><i class=\"fa fa-arrow-right\"><\/i><\/a><\/p>\n","protected":false},"author":532,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-9746","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-uncategorized","7":"h-entry","9":"h-as-article"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Pheonix Solutions - We Empower Your Business Growth<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-\u2192-logstash-\u2192-kibana\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pheonix Solutions - We Empower Your Business Growth\" \/>\n<meta property=\"og:description\" content=\"Introduction In modern containerized environments, centralized logging is essential for monitoring, troubleshooting, and maintaining application reliability. Kubernetes workloads generate logs across multiple pods and nodes, which makes log management challenging if logs remain distributed. To solve this, organizations often use the ELK Stack (Elasticsearch, Logstash, and Kibana) for centralized logging&hellip; Continue Reading Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-\u2192-logstash-\u2192-kibana\/\" \/>\n<meta property=\"og:site_name\" content=\"PHEONIXSOLUTIONS\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-11T12:15:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-11T12:16:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1025\" \/>\n\t<meta property=\"og:image:height\" content=\"18\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"thiyagarajan V\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@pheonixsolution\" \/>\n<meta name=\"twitter:site\" content=\"@pheonixsolution\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"thiyagarajan V\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/\"},\"author\":{\"name\":\"thiyagarajan V\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/74f51f35c7a7748db459b46c7840def4\"},\"headline\":\"Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)\",\"datePublished\":\"2026-03-11T12:15:30+00:00\",\"dateModified\":\"2026-03-11T12:16:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/\"},\"wordCount\":544,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/Screenshot-2026-03-11-112218.png\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/\",\"name\":\"Pheonix Solutions - We Empower Your Business Growth\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/Screenshot-2026-03-11-112218.png\",\"datePublished\":\"2026-03-11T12:15:30+00:00\",\"dateModified\":\"2026-03-11T12:16:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/Screenshot-2026-03-11-112218.png\",\"contentUrl\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/Screenshot-2026-03-11-112218.png\",\"width\":1025,\"height\":18},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\",\"name\":\"Pheonix Solutions\",\"description\":\"We Empower Your Business Growth\",\"publisher\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\",\"name\":\"PheonixSolutions\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/12\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/12\\\/logo.png\",\"width\":454,\"height\":300,\"caption\":\"PheonixSolutions\"},\"image\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/PheonixSolutions-209942982759387\\\/\",\"https:\\\/\\\/x.com\\\/pheonixsolution\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/74f51f35c7a7748db459b46c7840def4\",\"name\":\"thiyagarajan V\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g\",\"caption\":\"thiyagarajan V\"},\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/author\\\/thiyagarajan\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Pheonix Solutions - We Empower Your Business Growth","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-\u2192-logstash-\u2192-kibana\/","og_locale":"en_US","og_type":"article","og_title":"Pheonix Solutions - We Empower Your Business Growth","og_description":"Introduction In modern containerized environments, centralized logging is essential for monitoring, troubleshooting, and maintaining application reliability. Kubernetes workloads generate logs across multiple pods and nodes, which makes log management challenging if logs remain distributed. To solve this, organizations often use the ELK Stack (Elasticsearch, Logstash, and Kibana) for centralized logging&hellip; Continue Reading Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)","og_url":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-\u2192-logstash-\u2192-kibana\/","og_site_name":"PHEONIXSOLUTIONS","article_publisher":"https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/","article_published_time":"2026-03-11T12:15:30+00:00","article_modified_time":"2026-03-11T12:16:22+00:00","og_image":[{"width":1025,"height":18,"url":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png","type":"image\/png"}],"author":"thiyagarajan V","twitter_card":"summary_large_image","twitter_creator":"@pheonixsolution","twitter_site":"@pheonixsolution","twitter_misc":{"Written by":"thiyagarajan V","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#article","isPartOf":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/"},"author":{"name":"thiyagarajan V","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/person\/74f51f35c7a7748db459b46c7840def4"},"headline":"Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)","datePublished":"2026-03-11T12:15:30+00:00","dateModified":"2026-03-11T12:16:22+00:00","mainEntityOfPage":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/"},"wordCount":544,"commentCount":0,"publisher":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#organization"},"image":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#primaryimage"},"thumbnailUrl":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/","url":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/","name":"Pheonix Solutions - We Empower Your Business Growth","isPartOf":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#primaryimage"},"image":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#primaryimage"},"thumbnailUrl":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png","datePublished":"2026-03-11T12:15:30+00:00","dateModified":"2026-03-11T12:16:22+00:00","breadcrumb":{"@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#primaryimage","url":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png","contentUrl":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2026\/03\/Screenshot-2026-03-11-112218.png","width":1025,"height":18},{"@type":"BreadcrumbList","@id":"https:\/\/pheonixsolutions.com\/blog\/kubernetes-elk-logging-setup-filebeat-%e2%86%92-logstash-%e2%86%92-kibana\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pheonixsolutions.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kubernetes ELK Logging Setup (Filebeat \u2192 Logstash \u2192 Kibana)"}]},{"@type":"WebSite","@id":"https:\/\/pheonixsolutions.com\/blog\/#website","url":"https:\/\/pheonixsolutions.com\/blog\/","name":"Pheonix Solutions","description":"We Empower Your Business Growth","publisher":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pheonixsolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/pheonixsolutions.com\/blog\/#organization","name":"PheonixSolutions","url":"https:\/\/pheonixsolutions.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/12\/logo.png","contentUrl":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/12\/logo.png","width":454,"height":300,"caption":"PheonixSolutions"},"image":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/","https:\/\/x.com\/pheonixsolution"]},{"@type":"Person","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/person\/74f51f35c7a7748db459b46c7840def4","name":"thiyagarajan V","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ee2869bd14622272f64481a22d08f344cf374add59cc30ba7b8f3e887b120b9a?s=96&r=g","caption":"thiyagarajan V"},"url":"https:\/\/pheonixsolutions.com\/blog\/author\/thiyagarajan\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p7F4uM-2xc","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9746","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/532"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=9746"}],"version-history":[{"count":6,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9746\/revisions"}],"predecessor-version":[{"id":9834,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9746\/revisions\/9834"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=9746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=9746"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=9746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}