# Beats -\> Logstash security, use of security token to authenticate clients?

**URL:** <https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981>\
**Category:** Logstash\
**Created:** [October 24, 2017, 12:24am UTC](https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981 "2017-10-24T00:24:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick-george](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick-george/32/23318_2.png) [@nick-george](https://discuss.elastic.co/u/nick-george)\
**Post date:** [October 24, 2017, 12:24am UTC](https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981/1 "2017-10-24T00:24:37Z")

</div>

Hi,

I run logstash in a cloud environment and due to the fact I do not control our client's systems, cannot enforce the use of client certificates with beats. What would be great is if all Beats (not just filebeat) supported the use of a security token. Where if the token doesn't match, then the incoming data is dropped from Logstash.

It is currently possible to implement this through the use of adding a token to a field (in the client beat), then checking the value of that token in the logstash configuration. From a security perspective, I'd feel much more comfortable if the logstash beat input was the one dropping logs that have failed the token check as it would happen before the log ever hits the logstash event pipeline.

Is there any chance of this style of "authentication" being implemented?

Cheers,  
Nick

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 24, 2017, 5:17am UTC](https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981/2 "2017-10-24T05:17:29Z")

</div>

You'll probably have a better chance of reaching the core developers if you post a GitHub issue.

---

<div class="post-metadata">

**Author:** ![nick-george](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick-george/32/23318_2.png) [@nick-george](https://discuss.elastic.co/u/nick-george)\
**Post date:** [October 24, 2017, 5:45am UTC](https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981/3 "2017-10-24T05:45:25Z")

</div>

Thanks Magnus, have done.

Nick

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2017, 5:45am UTC](https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981/4 "2017-11-21T05:45:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.