# Checking client cert subject in Logstash
**URL:** https://discuss.elastic.co/t/checking-client-cert-subject-in-logstash/287625
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [October 25, 2021, 8:49pm UTC](https://discuss.elastic.co/t/checking-client-cert-subject-in-logstash/287625 "2021-10-25T20:49:11Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jceddy](https://discuss.elastic.co/u/jceddy)
#### Post date: [October 25, 2021, 8:49pm UTC](https://discuss.elastic.co/t/checking-client-cert-subject-in-logstash/287625/1 "2021-10-25T20:49:11Z")
I have Logstash set up receiving data from Filebeat on external servers, with SSL mutual authentication.
I would like to add one more layer and only allow through when Filebeat's client certificate subject matches a string or regular expression.
It seems like I should be able to do something like this:
```auto
input {
beats {
port => 5045
ssl => true
ssl_certificate_authorities => ["/etc/logstash/ca.crt"]
ssl_certificate => "/etc/logstash/{{ node_name }}.crt"
ssl_key => "/etc/logstash/{{ node_name }}.pkcs8.key"
}
}
output {
if [@metadata][tls_peer][subject] =~ /{{ elk_node }}-filebeat/ {
if [fields][log_for] {
elasticsearch {
ssl => true
ssl_certificate_verification => true
cacert => '/etc/logstash/ca.crt'
hosts => [{{ logstash_elasticsearch_hosts }}]
user => "{{ logstash_elasticsearch_user }}"
password => "{{ logstash_elasticsearch_password }}"
index => "logstash-%{[fields][log_for]}-%{+YYYY.MM.dd}"
}
}
}
}
```
But the relevant metadata doesn't appear to be available.
What am I missing?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2021, 8:49pm UTC](https://discuss.elastic.co/t/checking-client-cert-subject-in-logstash/287625/2 "2021-11-22T20:49:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.