# Bletcherous Logstash Elasticsearch filter ConfigurationError

**URL:** <https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [July 19, 2024, 3:13pm UTC](https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443 "2024-07-19T15:13:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Brooks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_brooks/32/123130_2.png) [@Gary\_Brooks](https://discuss.elastic.co/u/Gary_Brooks)\
**Post date:** [July 19, 2024, 3:13pm UTC](https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443/1 "2024-07-19T15:13:27Z")

</div>

I'm receiving the "Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration." error message from a Logstash Elasticsearch filter. The filter is:

```auto
filter {	
	ruby {
     # code to define [batch_info] fields
  }

	if [batch_info][event_kind] == "End" {
		elasticsearch {
			index => "spark-active-index"  		
			hosts => ["${ELASTIC_HOSTS}"]
			user => "${ELASTIC_USER}"
			password => "${ELASTIC_PASSWORD}"
			cacert => "certs/ca/ca.crt"
			
			query => "batch_info.event_kind:Start AND batch_info.uid:%{[batch_info][start_uid]}"
			fields => { "batch_info_start" => "batch_info_start" }
      
		}
	}
}

```

Oddly, I use a pretty much the same plugin configuration in the output section. The following works just fine without the filter:

```auto
output {
	elasticsearch {
		index => "spark-active-index"  
		hosts => ["${ELASTIC_HOSTS}"]
		user => "${ELASTIC_USER}"
		password => "${ELASTIC_PASSWORD}"
		cacert => "/usr/share/logstash/certs/ca/ca.crt"
	}
}

```

I've tried paring back the plugin configuration, in many different ways to isolate the issue, but to no avail. Either, I receive the same ConfigurationError or a different error because of a required configuration. For example, in some configurations if you omit the cacert configuration, you'll receive an error notifying to that effect. I've also tried literal values in place of the environment variables, but again to no avail. I also tried upgrading to the latest Logstash (v8.14.3), with no change in behaviors. Any pointers or suggestions would be appreciated.

The filter, above, is based of the example in [Elasticsearch filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html#plugins-filters-elasticsearch-common-options). My overall Docker-Elastic environment is derived from Getting started with the [Elastic Stack and Docker Compose: Part 1](https://www.elastic.co/blog/getting-started-with-the-elastic-stack-and-docker-compose).

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 19, 2024, 4:54pm UTC](https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443/2 "2024-07-19T16:54:00Z")

</div>

> [@Gary\_Brooks](#):
>
> I'm receiving the "Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration." error message from a Logstash Elasticsearch filter.

If you look closely you will see the error message immediately preceding that:

```auto
[ERROR][logstash.filters.elasticsearch] Unknown setting 'cacert' for elasticsearch

```

You probably want the [ca\_trusted\_fingerprint](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html#plugins-filters-elasticsearch-ca_trusted_fingerprint) option. It strikes me as unusual to trust a fingerprint rather than a cert, but that's the option that is provided.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 19, 2024, 4:57pm UTC](https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443/3 "2024-07-19T16:57:42Z")

</div>

Hi @Gary_Brooks Welcome to the community.

Or

> **[Elasticsearch output plugin | Logstash Reference \[8.14\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ssl_certificate_authorities)**

> ### `ssl_certificate_authorities`
> 
> - Value type is a list of [path](https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html#path)
> - There is no default value for this setting
> 
> The .cer or .pem files to validate the server’s certificate.

This is the new setting that replaces `cacert`

---

<div class="post-metadata">

**Author:** ![Gary\_Brooks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_brooks/32/123130_2.png) [@Gary\_Brooks](https://discuss.elastic.co/u/Gary_Brooks)\
**Post date:** [July 21, 2024, 11:23am UTC](https://discuss.elastic.co/t/bletcherous-logstash-elasticsearch-filter-configurationerror/363443/4 "2024-07-21T11:23:18Z")

</div>

Thanks! Replacing _cacert \<X\>_ with _ssl\_certificate\_authorities [\<X\>]_ worked. I appreciated the timeliness of your responses.