# Environment variable for setting logstash CA file for xpack monitoring

**URL:** <https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring, docker\
**Created:** [September 24, 2019, 1:33pm UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879 "2019-09-24T13:33:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [September 24, 2019, 1:33pm UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879/1 "2019-09-24T13:33:52Z")

</div>

I am trying to setup Docker Logstash with xpack monitoring, however I am not able to get the environment variable for specifying the CA file location.  
`xpack.monitoring.elasticsearch.ssl.certificate_authority`

Here is the docker-compose file for Logstash

```auto
version: "3.7"
services:
  logstash01:
    image: docker.elastic.co/logstash/logstash:7.2.1
    container_name: logstash01
    ports:
      - "11000-11100:11000-11100"
      - "11000-11100:11000-11100/udp"
    networks:
      - logstash
    environment:
      NODE_NAME: logstash01
      CONFIG_RELOAD_AUTOMATIC: "true"
      QUEUE_TYPE: persisted
      QUEUE_MAX_BYTES: 2gb
      XPACK_MONITORING_ENABLED: "true"
      XPACK_MONITORING_ELASTICSEARCH_USERNAME: logstash_system
      XPACK_MONITORING_ELASTICSEARCH_PASSWORD: <snip>
      XPACK_MONITORING_ELASTICSEARCH_HOSTS: https://elasticsearch01:9200
      XPACK_MONITORING_ELASTICSEARCH_SSL_CERTIFICATEAUTHORITY: /usr/share/logstash/certs/cert.crt
    volumes:
      - type: volume
        source: logstash_cache
        target: /usr/share/logstash/data/queue
        volume:
          nocopy: true
      - type: volume
        source: logstash_pipelines
        target: /usr/share/logstash/pipeline
        volume:
          nocopy: true
      - type: volume
        source: logstash_certs
        target: /usr/share/logstash/certs
        volume:
          nocopy: true
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "1"
    restart: unless-stopped
networks:
  logstash:
    driver: bridge
    ipam:
      config:
        - subnet: 10.111.2.0/24
volumes:
  logstash_cache:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/persist_cache"
  logstash_pipelines:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/pipeline"
  logstash_certs:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/certs"

```

When I enter the container and look at the generated yml file I do not see the certificate\_authority value at all:

```auto
cat config/logstash.yml
config.reload.automatic: true
http.host: 0.0.0.0
node.name: logstash01
queue.max_bytes: 2gb
queue.type: persisted
xpack.monitoring.elasticsearch.hosts: https://elasticsearch01:9200
xpack.monitoring.elasticsearch.password: <snip>
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.enabled: true

```

Any help would be appreciated as this has been bothering me for a few days now with no luck on finding a solution.

---

<div class="post-metadata">

**Author:** ![Mike\_Place](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_place/32/39555_2.png) [@Mike\_Place](https://discuss.elastic.co/u/Mike_Place)\
**Post date:** [September 24, 2019, 1:57pm UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879/2 "2019-09-24T13:57:55Z")

</div>

@jarpy I think you might have worked on this Docker image and `env2yaml` at some point. Does anything come to mind here?

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [September 25, 2019, 1:13pm UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879/3 "2019-09-25T13:13:16Z")

</div>

I was able to get this to work by using the following docker-compose file:

```auto
version: "3.7"
services:
  logstash01:
    image: docker.elastic.co/logstash/logstash:7.2.1
    container_name: logstash01
    ports:
      - "11000-11100:11000-11100"
      - "11000-11100:11000-11100/udp"
    networks:
      - logstash
    environment:
      NODE_NAME: logstash01
      CONFIG_RELOAD_AUTOMATIC: "true"
      QUEUE_TYPE: persisted
      QUEUE_MAX_BYTES: 2gb
      XPACK_MONITORING_ENABLED: "true"
      XPACK_MONITORING_ELASTICSEARCH_USERNAME: logstash_system
      XPACK_MONITORING_ELASTICSEARCH_PASSWORD: <snip>
      XPACK_MONITORING_ELASTICSEARCH_HOSTS: https://elasticsearch01:9200
      xpack.monitoring.elasticsearch.ssl.certificate_authority: /usr/share/logstash/certs/cert.crt
    volumes:
      - type: volume
        source: logstash_cache
        target: /usr/share/logstash/data/queue
        volume:
          nocopy: true
      - type: volume
        source: logstash_pipelines
        target: /usr/share/logstash/pipeline
        volume:
          nocopy: true
      - type: volume
        source: logstash_certs
        target: /usr/share/logstash/certs
        volume:
          nocopy: true
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "1"
    restart: unless-stopped
networks:
  logstash:
    driver: bridge
    ipam:
      config:
        - subnet: 10.111.2.0/24
volumes:
  logstash_cache:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/persist_cache"
  logstash_pipelines:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/pipeline"
  logstash_certs:
    driver_opts:
      type: nfs
      o: "addr=10.10.25.1,hard,tcp,nolock,sync,rw"
      device: ":/mnt/data/logstash/certs"

```

I am not sure why the environment variable does not work as explained in the docs, but this way appears to work correctly.

---

<div class="post-metadata">

**Author:** ![jarpy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jarpy/32/51290_2.png) [@jarpy](https://discuss.elastic.co/u/jarpy)\
**Post date:** [September 30, 2019, 2:38am UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879/4 "2019-09-30T02:38:28Z")

</div>

Sorry for the slow response. It looks like the initial version was missing the last underscore. It seems to work if you add it in:

```auto
$ docker run --rm -it \
  -e XPACK_MONITORING_ELASTICSEARCH_SSL_CERTIFICATE_AUTHORITY=canary \
  docker.elastic.co/logstash/logstash:7.1.1 \
  cat /usr/share/logstash/config/logstash.yml | grep canary

xpack.monitoring.elasticsearch.ssl.certificate_authority: canary

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2019, 2:38am UTC](https://discuss.elastic.co/t/environment-variable-for-setting-logstash-ca-file-for-xpack-monitoring/200879/5 "2019-10-28T02:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.