Filebeat version 6.1 for Windows
Logstash version 6.1 on Ubuntu 16:04
Curl running from Ubuntu 16:04
I've followed the instructions https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html to setup SSL after getting a working system without SSL. I don't want to use a client certificate so my filebeat output config is this:
output.logstash:
# The Logstash hosts
hosts: ["logstash-1.internal.local:5044"]
(Note, URL domain has been changed for privacy). I have enabled ssl in the logstash beats input like this:
input {
beats {
port => "5044"
ssl => true
ssl_certificate => "/etc/ssl/certs/wildcard4-combined.cer"
ssl_key => "/etc/ssl/private/wildcard4.pem"
}
}
The certificate is a valid cert chained to a trusted root (the help documentation should not assume that you are using self-signed certificates!) but when I try and run curl -v against the host to verify the connection, I get the following error:
* Rebuilt URL to: https://logstash-1.internal.local:5044/
* Trying 10.1.26.23...
* Connected to logstash-1.internal.local (10.1.26.23) port 5044 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 595 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: *.internal.local (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: OU=Domain Control Validated,OU=PositiveSSL Wildcard,CN=*.internal.local
* start date: Thu, 14 Jan 2016 00:00:00 GMT
* expire date: Sat, 13 Apr 2019 23:59:59 GMT
* issuer: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA
* compression: NULL
* ALPN, server did not agree to a protocol
> GET / HTTP/1.1
> Host: logstash-1.internal.local:5044
> User-Agent: curl/7.47.0
> Accept: */*
>
* GnuTLS recv error (-54): Error in the pull function.
* Closing connection 0
curl: (56) GnuTLS recv error (-54): Error in the pull function.
I was initially trying to run logstash behind an nginx proxy and if I run curl -v against nginx, it works fine so the implication from the error is that logstash (or jruby-openssl) doesn't support enough cipher suites and specifically, not what curl is trying to use. I ran a bash script to test supported ciphers suites. nginx supports 13, logstash only supports 4. Since this will only move in one direction, if this is the problem, then logstash needs updating urgently to support newer cipher suites for SSL to be usable.
If I try and run filebeat (from Windows if it's important) with this configuration, I get the following:
2018/01/31 09:39:28.188930 output.go:92: ERR Failed to publish events: client is not connected
2018/01/31 09:39:28.230972 async.go:235: ERR Failed to publish events caused by: lumberjack protocol error
2018/01/31 09:39:28.231973 async.go:235: ERR Failed to publish events caused by: client is not connected