# Beats not able to connect with Logstash **URL:** \ **Category:** Logstash\ **Created:** [May 15, 2021, 9:21pm UTC](https://discuss.elastic.co/t/beats-not-able-to-connect-with-logstash/273093 "2021-05-15T21:21:23Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![robinhood\_lko](https://avatars.discourse-cdn.com/v4/letter/r/5f8ce5/32.png) [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Post date:** [May 15, 2021, 9:21pm UTC](https://discuss.elastic.co/t/beats-not-able-to-connect-with-logstash/273093/1 "2021-05-15T21:21:23Z")
Hi All, I have deployed ELK Stack using OSS versions Elasticsearch and Kibana. While connecting with Beats using Logstash, I am seeing following error on the system. Please can someone help me on this. Thanks ```auto [2021-05-15T20:57:35,512][WARN][io.netty.channel.DefaultChannelPipeline][main][prd] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Extended key usage does not permit use for TLS client authentication at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:650) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:576) ~[netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-all-4.1.49.Final.jar:4.1.49.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.49.Final.jar:4.1.49.Final] at java.lang.Thread.run(Thread.java:834) [?:?] Caused by: javax.net.ssl.SSLHandshakeException: Extended key usage does not permit use for TLS client authentication at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:326) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:269) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:264) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkClientCerts(CertificateMessage.java:691) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:402) ~[?:?] at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:366) ~[?:?] at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392) ~[?:?] at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) ~[?:?] at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1074) ~[?:?] at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1061) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:?] ``` The config logstash.conf ```auto input { beats { port => 5044 id => "prd" ssl => true ssl_verify_mode => "none" ssl_certificate_authorities => "/usr/share/logstash/config/dev-root.crt" ssl_certificate => "/usr/share/logstash/config/dev-client.crt" ssl_key => "/usr/share/logstash/config/dev-key.pem" } } output { elasticsearch { hosts => ["https://dev-elasticsearch:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}" cacert => "/usr/share/logstash/config/rootCA.pem" user => "admin" password => "xxxxxxxx" ssl_certificate_verification => "false" ssl => "true" } } ``` Filebeat - ```auto output.logstash: # The Logstash hosts hosts: ["logstash:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate_authorities: ["dev-root.crt"] # Certificate for SSL client authentication ssl.certificate: "dev-client.crt" # Client Certificate Key ssl.key: "dev-key.pem" ssl_verify_mode: "none" ``` logstash keys were converted using following command ```auto openssl pkcs8 -topk8 -nocrypt -in logstash.key -out dev-key.pem ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 15, 2021, 10:37pm UTC](https://discuss.elastic.co/t/beats-not-able-to-connect-with-logstash/273093/2 "2021-05-15T22:37:41Z")
> [@robinhood\_lko](#): > > `Extended key usage does not permit use for TLS client authentication` Answered [here](https://discuss.elastic.co/t/ssl-between-elastic-nodes-is-failing/91925/2). You will need to generate a new certificate. ---
**Author:** ![robinhood\_lko](https://avatars.discourse-cdn.com/v4/letter/r/5f8ce5/32.png) [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Post date:** [May 16, 2021, 4:29pm UTC](https://discuss.elastic.co/t/beats-not-able-to-connect-with-logstash/273093/3 "2021-05-16T16:29:09Z")
Thanks Badger for the quick response. I have tried this solution mentioned here and it worked for me. Thanks a lot for quick help. > [@Filebeat to Logstash over SSL](https://discuss.elastic.co/t/filebeat-to-logstash-over-ssl/122735/5): > > @Ben96 Thank you for your replies. I'm posting this in hopes it helps someone else down the line. After working with our support, the solution is to NOT specify the CA in the pipeline input and to NOT specify the HTTPS protocol in the Filebeat output. Communication to Logstash is not HTTPS (it's some other protocol leftover from Lumberjack) and there's something weird about specifying the CA in the input when it's not needed to authenticate the client. Here's the working config: filebeat.ym… ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 13, 2021, 4:30pm UTC](https://discuss.elastic.co/t/beats-not-able-to-connect-with-logstash/273093/4 "2021-06-13T16:30:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.