Error using https in filter section

Elastic Stack Logstash
1

Hi All,

I've gotten my logstash script working without https to port 9200.
However, I have turned on encryption but I cannot figure out why the filter section fails but the output section for the https works.

                # For updating of pool reference list
                mutate { add_field => { "ip_number" => "%{[IP_First_Integer]}" } }
                elasticsearch {
                        index => "singtel_dhcp_pool"
                        hosts => ["https://elk3:9200"]
                        user => "elastic"
                        password => "xxxxx"
                        ssl => true
                        ca_file => "/etc/logstash/ca.crt"

                        query_template => "/etc/logstash/conf.d/dhcp_pool_query.json"

                        fields => {
                                "Pool_Name" => "update"
                        }
                }
                mutate { remove_field => [ "ip_number" ] }

The error I am getting is.

[INFO ] 2021-07-28 04:37:19.117 [[main]-pipeline-manager] elasticsearch - New ElasticSearch filter client {:hosts=>[{:host=>"https://elk3:9200", :scheme=>"https"}]}
[ERROR] 2021-07-28 04:37:19.385 [[main]-pipeline-manager] javapipeline - Pipeline error {:pipeline_id=>"main", :exception=>#<Manticore::ResolutionFailure: https: Temporary failure in name resolution>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:274:in `call_once'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:158:in `code'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:84:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/base.rb:262:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/transport/http/manticore.rb:67:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-transport-5.0.5/lib/elasticsearch/transport/client.rb:131:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/elasticsearch-api-5.0.5/lib/elasticsearch/api/actions/ping.rb:20:in `ping'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.9.0/lib/logstash/filters/elasticsearch.rb:310:in `test_connection!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-elasticsearch-3.9.0/lib/logstash/filters/elasticsearch.rb:117:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:586:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/dhcp2.config"], :thread=>"#<Thread:0x40f63bef run>"}
[INFO ] 2021-07-28 04:37:19.388 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}
[ERROR] 2021-07-28 04:37:19.444 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

The output section

output {

        if [document_type] == "dhcp_pool" or [fields][document_type] == "dhcp_pool" {
                stdout { }
                if [document_id] {
                        elasticsearch {
                                hosts => ["https://elk3:9200"]
                                user => "elastic"
                                password => "xxxx"
                                index => "singtel_dhcp_pool"
                                ssl => true
                                cacert => "/etc/logstash/ca.crt"
                                document_id => "%{update}"
                                action => delete
                        }
                }
                elasticsearch {
                        hosts => ["https://elk3:9200"]
                        user => "elastic"
                        password => "xxxx"
                        ssl => true
                        cacert => "/etc/logstash/ca.crt"
                        index => "singtel_dhcp_pool"
                        document_id => "%{Pool_Name}"
                }
        }
}

Is it something wrong with the ssl section of the filter?

Regards,

Michael

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.