# A big trouble about from filebeat to logstash use SSL to transition **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 17, 2017, 7:46am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537 "2017-04-17T07:46:42Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Post date:** [April 17, 2017, 7:46am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/1 "2017-04-17T07:46:42Z")
dear all: i have a big trouble about two weeks when i install the plugin x-pack kibana & elasticsearch & logstash between kibana and elasticsearch linked to use username/password between logstash and elasticsearch lined to use username/password between filebeat and logstash linked to use SSL but result failed logstash service is normal running have not error log bug filebeat has some error filebeat error log info info : 2017/04/17 06:15:33.530280 single.go:140: ERR Connecting error publishing events (retrying): dial tcp 218.241.115.114:5043: getsockopt: connection refused ##logstash no start ERR Failed to publish events caused by: read tcp 218.241.115.71:34914-\>218.241.115.114:5043: read: connection reset by peer 2017/04/17 06:19:29.782544 single.go:91: INFO Error publishing events (retrying): read tcp x.x.x.x:34904-\>y.y.y.y:5043: read: connection reset by peer 2017/04/17 06:19:56.492100 metrics.go:39: INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=1 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.write\_bytes=265 libbeat.logstash.published\_but\_not\_acked\_events=1028 below logstash config input { beats { port =\> "5043" ssl =\> true ssl\_certificate\_authorities =\> ["/home/ops/server\_cert/cacert.pem"] ssl\_certificate =\> "/home/ops/server\_cert/newcert.pem" ssl\_key =\> "/home/ops/server\_cert/newkey.pkcs8" ssl\_verify\_mode =\>"force\_peer" key\_passpharse =\> "1234" } } filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %{DATA:domain} %{NUMBER:nb1} %{NUMBER:nb2} " } } } output { elasticsearch { hosts =\> ["1.1.1.1:9200","1.1.1.2:9200"] index =\> "logstash-%{[fields][logtype]}-%{+YYYY.MM.dd}" user =\> "elastic" password =\> "abc123" } } below filebeat config filebeat.prospectors: - input\_type: log paths: - /home/ops/nginx/logs/server-perf.log exclude\_lines: ["DEBUG -"] fields: logtype: "servernginx" output.logstash: hosts: ["1.1.1.2:5043"] protocol: https supported\_protocols: SSLv3 sls.certificate\_authorities: ["/home/ops/client\_cert/cacert.pem"] sls.certificate: "/home/ops/client\_cert/newcert.pem" sls.key : "/home/ops/client\_cert/newkey.pkcs8" key\_passpharse: "1234" logging.level: "debug" ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [April 17, 2017, 2:05pm UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/2 "2017-04-17T14:05:33Z")
You might have a typo: `sls.certificate` instead of `ssl.certificate`, `sls.key` instead of `ssl.key` etc. ---
**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Post date:** [April 18, 2017, 1:04am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/3 "2017-04-18T01:04:15Z")
Thank you @tudor ---
**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Post date:** [April 18, 2017, 3:28am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/4 "2017-04-18T03:28:14Z")
when i set the hostname logstash01 for logstash server , add filebeat server hosts file content :"1.1.1.2 logstash01" and the certificate common name set logstash01 for logstash server bellow filebeat debug log info: 2017/04/18 03:21:42.864263 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.publisher.published\_events=1040 registrar.writes=1 2017/04/18 03:21:44.151372 single.go:140: ERR Connecting error publishing events (retrying): x509: cannot validate certificate for 1.1.1.2 because it doesn't contain any IP SANs ---
**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Post date:** [April 18, 2017, 5:42am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/5 "2017-04-18T05:42:14Z")
how analysis history log file not on time because out cluster has crashed two weeks i think that i want make up history log file into ELK cluster ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 20, 2017, 9:38am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/6 "2017-04-20T09:38:22Z")
With SSL/TLS the servers certificate will hold the IP/Domain-name, the certificate was signed for. The client will compare the certificates IP/Domain with the address used to connect the beat with logstash. Having a hostname in the certificate, but configure an IP in beats won't work. Why `SSLv3`? This is so outdated. I'd recommend TLS 1.2 (if supported by java version used to run logstash). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2017, 9:52am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537/7 "2017-05-18T09:52:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.