Beats output to Logstash over HTTP?

Elastic Stack Beats
1

Hi,

I've been looking around to find a way to ship events from various libbeat applications to Logstash, but I need to do it over HTTP using basic authentication.

I have seen that libbeat is able to ship to Elasticsearch using this method, but I am trying to do so for Logstash.

I have seen that Logstash has a plugin for http input, but I am unaware if this would work with any libbeat application, and there is no reference of it anywhere.

Note: I am not asking for HTTPS or any SSL, only HTTP with basic authentication

Is it possible to somehow use the libbeat 'elasticsearch' http-based output with Logstash http input?

Does anyone have any experience with this?

Thanks for any advice.

PS: I've seen this thread, but it seems to be asking specifically about HTTPS authentication, using SSL.

2

beats->logstash is based on a custom protocol on plain TCP connection.

Never tried to hijack elasticsearch output in order to send to logstash. Problem is the output uses the elasticsearch bulk-API which logstash might have problems with.

3

Thanks very much,

From research, it seems like this might either be one of a few limited options:

  1. use elasticsearch output in beats to use http with basic authentication.
  2. use logstash output with TLS (requires setup of certs and/or CA).
  3. submit an enhancement for libbeat http output to the elastic/beats repository and see if it can be added.

Does anyone see anything missing?

Thanks.