Can not get input from elasticsearch

Elastic Stack Logstash
1

Hi, I wanna to get input from my elasticsearch and doing enrichment on the data in it but the problem is connecting to es via SSL, i get this error every time and can not handle it anyway

the code

input {
      elasticsearch {
                hosts => ["https://localhost:9200"]
                ssl=> true
                ca_file => "/usr/share/elasticsearch/rootCA.crt.pem"
                user => "user"
                password => "password"
                query => '{"query" : {"match_all" : {}}}'
                index => "utility"
      }
}

the error

[ERROR] 2020-06-28 11:12:14.992 [[main]<elasticsearch] javapipeline - A plugin had an unrecoverable error. Will restart this plugin.
  Pipeline_id:main
  Plugin: <LogStash::Inputs::Elasticsearch password=><password>, ca_file=>"/usr/share/elasticsearch/rootCA.crt.pem", hosts=>["https://localhost:9200"], query=>"{\"query\" : {\"match_all\" : {}}}", index=>"utility", id=>"77afca6e2babc6030ddd1ce9c7c208a2dd648596e5161d152ed8f57c4df66273", ssl=>true, user=>"siem_read", enable_metric=>true, codec=><LogStash::Codecs::JSON id=>"json_a5fbc092-54b7-4195-8c27-80eafa19219c", enable_metric=>true, charset=>"UTF-8">, size=>1000, scroll=>"1m", docinfo=>false, docinfo_target=>"@metadata", docinfo_fields=>["_index", "_type", "_id"]>
  Error: https
  Exception: Manticore::ResolutionFailure
  Stack: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'

any help would be grateful

2

This is a DNS resolution failure. If localhost resolves the only other hostname I can think it would be trying to resolve is for OCSP or a CRL. Check the details of the certificates involved to see what they use.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.