> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-kubernetes-engine/ingest-logs-from-google-kubernetes-engine.md). # Ingest logs from Google Kubernetes Engine Instead of forwarding Google Kubernetes Engine (GKE) logs directly to Google StackDrive, Cortex XSIAM can ingest container logs from GKE using Elasticsearch Filebeat. To receive logs, you must install Filebeat on your containers and enable Data Collection settings for Filebeat. When Cortex XSIAM begins receiving logs, the app automatically creates an Cortex Query Language (XQL) dataset using the vendor and product name that you specify during Filebeat setup. It is recommended to specify a descriptive name. For example, if you specify `google` as the vendor and `kubernetes` as the product, the dataset name will be `google_kubernetes_raw`. If you leave the product and vendor blank, Cortex XSIAM assigns the dataset a name of `container_container_raw`. After Cortex XSIAM creates the dataset, you can search your GKE logs using XQL Search. 1. Install Filebeat on your containers. For more information, see . 2. [Ingest logs from Elasticsearch Filebeat](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/elasticsearch-filebeat/ingest-logs-from-elasticsearch-filebeat.md). Record your token key and API URL for the Filebeat Collector instance as you will need these later in this workflow. 3. Deploy a Filebeat as a DaemonSet on Kubernetes. This ensures there is a running instance of Filebeat on each node of the cluster. a. Download the manifest file to a location where you can edit it. ``` curl -L -O https://raw.githubusercontent.com/elastic/beats/7.10/deploy/kubernetes/filebeat-kubernetes.yaml ``` b. Open the YAML file in your preferred text editor. c. Remove the `cloud.id` and `cloud.auth` lines.\ d. For the **`output.elasticsearch`** configuration, replace the **`hosts`**, **`username`**, and **`password`** with environment variable references for **`hosts`** and **`api_key`**, and add a field and value for **`compression_level`** and **`bulk_max_size`**.\ e. In the **`DaemonSet`** configuration, locate the **`env`** configuration and replace **`ELASTIC_CLOUD_AUTH`**, **`ELASTIC_CLOUD_ID`**, **`ELASTICSEARCH_USERNAME`**, **`ELASTICSEARCH_PASSWORD`**, **`ELASTICSEARCH_HOST`**, **`ELASTICSEARCH_PORT`** and their relative values with the following. * **`ELASTICSEARCH_ENDPOINT`:** Specify the API URL for your Cortex XSIAM tenant. You can copy the URL from the Filebeat Collector instance you set up for GKE in the Cortex XSIAM management console (Settings → (ConfigurationsData CollectionCustom CollectorsCopy API URL`https://api-tenant external URL:443/logs/v1/filebeat)` * **`ELASTICSEARCH_API_KEY`:** Specify the token key you recorded earlier during the configuration of your Filebeat Collector instance. After you configure these settings your configuration should look like the following image.![](/files/V59oiW2vmHzv3WKzex4W) f. Save your changes. 4. If you use RedHat OpenShift, you must also specify additional settings. See [https://www.elastic.co/guide/en/beats/filebeat/7.10/running-on-kubernetes.html](https://www.elastic.co/guide/en/beats/filebeat/7.10/running-on-kubernetes.html#_red_hat_openshift_configuration). 5. Deploy Filebeat on your Kubernetes. ``` kubectl create -f filebeat-kubernetes.yaml ``` This deploys Filebeat in the kube-system namespace. If you want to deploy the Filebeat configuration in other namespaces, change the namespace values in the YAML file (in any YAML inside this file) and add `-n `.\ \ After you deploy your configuration, the Filebeat DameonSet runs throughout your containers to forward logs to Cortex XSIAM. You can review the configuration from the Kubernetes Engine console: **Workloads → Filebeat → YAML**. {% hint style="info" %} **Note** Cortex XSIAM supports logs in single line format or multiline format. For more information on handling messages that span multiple lines of text in Elasticsearch Filebeat, see [Manage Multiline Messages](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html). {% endhint %} 6. After Cortex XSIAM begins receiving logs from GKE, you can use the XQL Search to search for logs in the new dataset. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-kubernetes-engine/ingest-logs-from-google-kubernetes-engine.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.