# Does Logstash "Elasticsearch" output plugin support client certificates

**URL:** <https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167>\
**Category:** Logstash\
**Created:** [September 12, 2017, 7:49am UTC](https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167 "2017-09-12T07:49:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bozzerreaneaux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bozzerreaneaux/32/21613_2.png) [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)\
**Post date:** [September 12, 2017, 7:49am UTC](https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167/1 "2017-09-12T07:49:21Z")

</div>

Hi Team ,

Does [Logstash "Elasticsearch" output plugin](https://www.elastic.co/guide/en/logstash/2.3/plugins-outputs-elasticsearch.html) support client certificates?

I can only see option there (cacert) to verify the ES node certificate but I would also like the Logstash pipeline to also identify itself with a client cert.

If there is no such option, is there a way to implement this with a different output plugin?

This is my config:

```
input {
  beats {
   port => 5044
   type => "log"
   host => "0.0.0.0"
   ssl => true
   ssl_certificate_authorities => ["C:/Program Files/filebeat-5.5.2/certs/ca.crt"]
   ssl_certificate => "C:/Program Files/filebeat-5.5.2/certs/Logstash-server.crt"
   ssl_key => "C:/Program Files/filebeat-5.5.2/certs/Logstash-server.p8"
   ssl_verify_mode => "force_peer"
  }
}

 output {
  stdout { codec => rubydebug } elasticsearch {
    hosts => ["https://xxxxxx:9200"]
	user => "xxxxx"
	password => "xxxxxx"
	ssl => true
	cacert => "C:/Program Files/filebeat-5.5.2/certs/ca.crt"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

In my set up I have:  
Filebeat and Logstash instence per each application server;  
Kibana and Elasticsearch on a single server.

Filebeat and Lgstash have been set up with mutual authentication and this works fine but I would also want to configure mutual authentication between ES and LS so that I can take advantage of the role based access within a PKI realm and assign different roles for each logstash pipeline.

Thanks a lot in advance!

--Boz

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 12, 2017, 8:09am UTC](https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167/2 "2017-09-12T08:09:57Z")

</div>

Hey,

I think you are searching for [these docs](https://www.elastic.co/guide/en/x-pack/current/logstash.html#ls-http-auth-pki) about setting up logstash with KPI?

--Alex

---

<div class="post-metadata">

**Author:** ![Bozzerreaneaux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bozzerreaneaux/32/21613_2.png) [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)\
**Post date:** [September 12, 2017, 8:21am UTC](https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167/3 "2017-09-12T08:21:39Z")

</div>

Hi Alex,

Тhanks for your response but I am using the **cacert** instead of the java truststore/keystore. In my understanding cacert and keystore/truststore options are different options to authenticating the ES server but I also need to be able to authenticate Logstash with a client certificate.

The [**http**](https://www.elastic.co/guide/en/logstash/2.3/plugins-outputs-http.html) output plugin for Logstash and some other plugins have those options?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2017, 8:21am UTC](https://discuss.elastic.co/t/does-logstash-elasticsearch-output-plugin-support-client-certificates/100167/4 "2017-10-10T08:21:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.