# Config Logstash with https to Elasticsearch cluster

**URL:** <https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/282053>\
**Category:** Logstash\
**Created:** [August 20, 2021, 9:19am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/282053 "2021-08-20T09:19:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kiran80511](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kiran80511/32/80487_2.png) [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Post date:** [August 20, 2021, 9:19am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/282053/1 "2021-08-20T09:19:24Z")

</div>

Error Logs in Logstash

```auto
Aug 20 14:28:50 elastic.sys logstash[5101]: [2021-08-20T14:28:50,172][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://logstash_writer:xxxxxx@elastic.sys:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'https://elastic.sys:9200/'"}

```

Logstash config file

```auto
input {
udp {
port => 5044
type => "syslog"

}

}
filter{
      if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{USERNAME:hostname}%{DATA:syslog_program}:%{GREEDYDATA:syslog_message}" }
}
date {
        match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
     }

ruby {
        code => "
            fieldArray = event.get('syslog_message').split(' ');
            for field in fieldArray
                name = field.split('=')[0];
                value = field.split('=')[1];
                 if value =~ /[0-9]/
                   if value =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
                      event.set(name, value)
                   else
                      if value =~ /[A-z]/
                        event.set(name, value)
                      else
                        event.set(name, value.to_i)
                      end
                   end
                else
                    event.set(name, value)

                end
            end
        "
    }
}

}
output {
  elasticsearch {
ilm_enabled => false
    hosts => ['https://elastic.sys:9200']
    cacert => '/etc/logstash/certs/ca.crt'
   user => 'logstash_writer'
    password => 'LiL14stC0M0BZw9iBAY9'
      index => "syslog"

  }
  stdout { codec => rubydebug }
}

```

elasticsearch log

```auto
[root@elastic elasticsearch]# tail elasticsearch.log
[2021-08-20T14:42:28,785][WARN][o.e.x.s.a.AuthenticationService] [elastic] Authentication to realm default_native failed - Password authentication failed for logstash_writer

```

I had tried many ways but can't resolve this error .. Plz help me

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2021, 9:19am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/282053/2 "2021-09-17T09:19:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.