Logs from the ECK stack

This chart stores and displays logs; it does not collect Kubernetes logs. Enable and configure Fluent Bit separately through the umbrella, including its destination, TLS trust, credentials, and cross-namespace network access. Collector configuration belongs to Fluent Bit.

Accessing Kibana

The default umbrella route is https://kibana.<domain>; see the integration guide before changing the host. ECK creates the bootstrap elastic account and, with the default umbrella release, stores its password in logging/logging-ek-es-elastic-user, key elastic. Retrieve it only through an authorized secret-management workflow; do not paste it into commands, tickets, terminal recordings, or Git. Use named least-privilege accounts for routine access rather than the bootstrap superuser.

The package’s ingestion test looks for Kubernetes pod records in logstash-*. That is a test expectation, not a guarantee for a customized collector. Use the index/data-stream names and fields emitted by your collector when creating a Kibana data view. Follow the upstream data-view guide and Discover guide, rather than older Index Patterns menu instructions.

Missing logs

Distinguish cluster health, collector delivery, and Kibana authorization/data-view configuration. Check workload status, collector errors, destination indices, and the user’s permissions. For HTTP 429 responses, investigate Elasticsearch indexing pressure as described in troubleshooting; increasing a collector buffer alone is not a general solution.