Elasticsearch output pipeline error with api_key

Elastic Stack Logstash
1

Hello, I created a Logstash config to send files on index of Elasticsearch 7.15.1, on the same server.
I got this error

[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Manticore::UnknownException: Unsupported or unrecognized SSL message>, :backtrace=>["/opt/logstash-7.15.1/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.1-java/lib/manticore/response.rb:36:in `block in initialize'"

Here is my logstash.yml:

xpack.monitoring.enabled: true
xpack.monitoring.pipeline.id: ["xxx", "yyy"]
xpack.monitoring.elasticsearch.hosts: "http://localhost:9200"
xpack.monitoring.elasticsearch.api_key: "9dfjeijroek:9eVqMml3Sh6dfdfd"
xpack.monitoring.collection.interval: 10s

And the Logstash config file:

input {
        file {
                path => "/elasticsearch/data/*" start_position => "beginning"
                }
}
filter {
        mutate {
                rename => { ".txt" => ".json" }
        }
}
output {
        elasticsearch {
                hosts => ["https://localhost:9200"]
                api_key => "9dfjeijroek:9eVqMml3Sh6dfdfd"
                ssl => true
        }
}

How can I resolve this problem ? Thanks anyway.

2

You have configured http in one place and https in the other. Is Elasticsearch using TLS?

1 Like
3

Thank you, I changed my config as this:
hosts => ["http://localhost:9200"]

I also added ssl certificate in my config:

output {
        elasticsearch {
                hosts => ["http://localhost:9200"]
                api_key => "9dfjeijroek:9eVqMml3Sh6dfdfd"
                ssl => true
                ssl_certificate => "/etc/client/cert.pem"
                ssl_key => "/etc/client/cert.key"
        }
}

And now I meet a new error:
Using api_key authentication requires SSL/TLS secured communication

4

@Badger Thanks a lot, I resolved the problem.

I added TLS on the HTTP layer:

And I modified my Logstash conf:

input {
        file {
                path => "/elasticsearch/data/*" start_position => "beginning" sincedb_path => "/dev/null"
                }
}
filter {
        mutate {
                rename => { ".txt" => ".json" }
        }
}
output {
        elasticsearch {
                hosts => ["https://localhost:9200"]
                index => "test"
                user => "elastic"
                password => "kjdfidoie"
                ssl => true
                cacert => "/etc/client/elasticsearch-ca.pem"
        }
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.