# Enabling beats to logstash flow for a secure elastic cluster

**URL:** <https://discuss.elastic.co/t/enabling-beats-to-logstash-flow-for-a-secure-elastic-cluster/183240>\
**Category:** Logstash\
**Created:** [May 29, 2019, 6:54am UTC](https://discuss.elastic.co/t/enabling-beats-to-logstash-flow-for-a-secure-elastic-cluster/183240 "2019-05-29T06:54:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arpit\_Khanna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arpit_khanna/32/40215_2.png) [@Arpit\_Khanna](https://discuss.elastic.co/u/Arpit_Khanna)\
**Post date:** [May 29, 2019, 6:54am UTC](https://discuss.elastic.co/t/enabling-beats-to-logstash-flow-for-a-secure-elastic-cluster/183240/1 "2019-05-29T06:54:55Z")

</div>

Hi , Thanks in advance for helping.  
I am trying to setup a secure ELK infra with a beats to push logs to it. This ELK infra has 1 Master and 2 data nodes, 1 kibana, 1 logstash and 1 filebeats. This Elastic cluster is secure for which following are the configurations:  
Master:

> bootstrap.memory\_lock: false  
> cluster.name: ClusterI4  
> http.port: 9200  
> network.host: 172.20.5.213  
> node.data: false  
> node.ingest: true  
> node.master: true  
> node.name: MasterNode  
> path.data: S:\Elastic\Data  
> path.logs: S:\Elastic\Logs  
> transport.tcp.port: 9300  
> xpack.license.self\_generated.type: basic  
> xpack.security.enabled: true  
> discovery.zen.ping.unicast.hosts: ["172.20.5.213","172.20.5.214:9301"]  
> xpack.monitoring.collection.enabled: true  
> xpack.security.transport.ssl.enabled: true  
> discovery.zen.minimum\_master\_nodes: 2  
> xpack.security.transport.ssl.verification\_mode: certificate  
> xpack.security.transport.ssl.keystore.path: S:\Elastic\Config\certificate-bundle\elastic-stack-ca.p12  
> xpack.security.transport.ssl.truststore.path: S:\Elastic\Config\certificate-bundle\elastic-stack-ca.p12

Data:

> bootstrap.memory\_lock: true  
> cluster.name: ClusterI4  
> http.port: 9200  
> network.host: 172.20.5.214  
> node.data: true  
> node.ingest: false  
> node.master: false  
> node.name: Data1  
> path.data: S:\Elastic\Elasticsearch\data  
> path.logs: S:\Elastic\Elasticsearch\logs  
> transport.tcp.port: 9301  
> xpack.license.self\_generated.type: basic  
> xpack.security.enabled: true  
> discovery.zen.ping.unicast.hosts: ["172.20.5.213:9300","172.20.5.214:9301"]  
> xpack.monitoring.collection.enabled: true  
> xpack.security.transport.ssl.enabled: true  
> xpack.security.transport.ssl.verification\_mode: certificate  
> xpack.security.transport.ssl.keystore.path: S:\Elastic\Elasticsearch\config\certificate-bundle\elastic-stack-ca.p12  
> xpack.security.transport.ssl.truststore.path: S:\Elastic\Elasticsearch\config\certificate-bundle\elastic-stack-ca.p12

The whole cluster is properly connected and working fine but the data is not able to flow from filebeats to logstash to elastic cluster. I guess the reason is the ssl configuration in both.

Logstash:

```
> input 
> {
> beats{
> port => 5044
> ssl => true
> ssl_certificate_authorities =>["C:\filebeat-7.1.0-windows-x86_64\filebeat-7.1.0-windows-x86_64\ca\ca.crt"]
> ssl_certificate => "C:\filebeat-7.1.0-windows-x86_64\filebeat-7.1.0-windows-x86_64\ca\ca.crt"
> ssl_key => "C:\filebeat-7.1.0-windows-x86_64\filebeat-7.1.0-windows-x86_64\ca\ca.key"
> ssl_verify_mode => "force_peer"
> }
>    
> }
> 
> filter {
> 		
> }
> output {
> elasticsearch {
> hosts => ["172.20.5.213:9200"]
> index => "%{indice}-%{+xxxx.ww}"
> ssl => true
> keystore => "C:\logstash-6.5.4\logstash-6.5.4\config\certificate-bundle\elastic-stack-ca.p12"
> truststore => "C:\logstash-6.5.4\logstash-6.5.4\config\certificate-bundle\elastic-stack-ca.p12"
> }
> }

```

Filebeat:

> ```
> filebeat.inputs:
> - type: log
> enabled: true
> paths:
> - C:\logs\*.nlog
> output.logstash:
> hosts: ["localhost:5044"]
> ssl.certificate_authorities: ["C:\filebeat-7.1.0-windows-x86_64\filebeat-7.1.0-windows-x86_64\ca\ca.crt"]
> ssl.certificate: "C://filebeat-7.1.0-windows-x86_64//filebeat-7.1.0-windows-x86_64//ca//ca.crt"
> ssl.key: "C://filebeat-7.1.0-windows-x86_64//filebeat-7.1.0-windows-x86_64//ca//ca.crt"
> 
> ```

Logs in filebeat were as follows:  
2019-05-29T07:22:35.631-0700 ERROR instance/beat.go:802 Exiting: error initializing publisher: 1 error: tls: found a certificate rather than a key in the PEM for the private key

Can someone help me to rectify the log flow.

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2019, 12:39pm UTC](https://discuss.elastic.co/t/enabling-beats-to-logstash-flow-for-a-secure-elastic-cluster/183240/2 "2019-05-29T12:39:16Z")

</div>

> [@Arpit\_Khanna](#):
>
> 2019-05-29T07:22:35.631-0700 ERROR instance/beat.go:802 Exiting: error initializing publisher: 1 error: tls: found a certificate rather than a key in the PEM for the private key

Your configuration has the same value for output.logstash / ssl.key as it has for output.logstash / ssl.certificate. It wants a key file, not a crt file. You can use openssl to extract the key from a combined key/cert file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 12:39pm UTC](https://discuss.elastic.co/t/enabling-beats-to-logstash-flow-for-a-secure-elastic-cluster/183240/3 "2019-06-26T12:39:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.