Step-by-Step: Set Up a SIEM Pipeline with Elasticsearch 8.0 and Filebeat 8.0 for K8s 1.36 Logs

Security Information and Event Management (SIEM) pipelines are critical for monitoring Kubernetes cluster activity, detecting anomalies, and meeting compliance requirements. This guide walks through deploying a production-ready SIEM pipeline using Elasticsearch 8.0 for log storage and search, Filebeat 8.0 for log collection, and Kubernetes 1.36 as the target cluster.

Prerequisites

Before starting, ensure you have:

A running Kubernetes 1.36 cluster with kubectl configured

Helm 3.10+ installed locally

At least 4 vCPUs and 8GB RAM available for Elasticsearch workloads

Basic familiarity with K8s manifests and Helm charts

Step 1: Deploy Elasticsearch 8.0

We will use the official Elastic Helm chart to deploy Elasticsearch 8.0.…