1. Create a new namespace called  external-logging  that will host the Filebeat Daemonset  and Logstash Deployment containers: 2. Create a new namespace called  external  that will host the containers to generate logs for  this example: 3. Copy the required Secret and ConfigMaps to the  external-logging  namespace. Note that  doing this provides any users with access to this namespace the ability to view the  authentication certificates for the platform ELK. In this example, only the required  certificates are extracted from the logging-elk-certs in kube-system. a. Copy the required files from the  logging-elk-certs  Secret i. Copy the  logging-elk-certs  Secret: ii. Remove all entries in  data except  for the following, using  kubectl -n  external-logging edit secret logging-elk-certs: b. Copy the  logging-elk-elasticsearch-pki-secret  Secret to the  external-logging namespace: c. Copy the  logging-elk-elasticsearch-entrypoint  ConfigMap: 4. Create a RoleBinding to the  ibm-anyuid-hostaccess-clusterrole  so that the Logstash  pod can use the host network to reach the external Elasticsearch: 5. Create the  filebeat-config.yaml  in Example 5-28. kubectl create namespace external-logging kubectl create namespace external - ca.crt - logstash.crt - logstash.key - filebeat.crt - filebeat.key kubectl -n kube-system get secret logging-elk-certs -o yaml | sed  "s/namespace: kube-system/namespace: external-logging/g" | kubectl -n  external-logging create -f - kubectl -n kube-system get secret logging-elk-elasticsearch-pki-secret -o  yaml | sed "s/namespace: kube-system/namespace: external-logging/g" |  kubectl -n external-logging create -f - kubectl -n kube-system get configmap logging-elk-elasticsearch-entrypoint -o  yaml | sed "s/namespace: kube-system/namespace: external-logging/g" |  kubectl -n external-logging create -f - kubectl -n external-logging create rolebinding  ibm-anyuid-hostaccess-rolebinding --clusterrole  ibm-anyuid-hostaccess-clusterrole --serviceaccount=external-logging:default Tip:  This step is not needed if Logstash is being deployed to  kube-system  namespace, as  it automatically inherits this privilege from the  ibm-privileged-psp  Pod Security Policy. apiVersion: v1 kind: ConfigMap metadata: labels: app: filebeat-ds Example 5-28 filebeat-config.yaml Chapter 5. Logging and monitoring  201