I am having an issue with my ssl connection to logstash, Filebeat says everything is ok,
C:\filebeat>filebeat test output
logstash: logstash:5044...
connection...
parse host... OK
dns lookup... OK
addresses: xx.xx.xx.xx
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.2
dial up... OK
talk to server... OK
ran >filebeat -c filebeat.yml -e -d "*"
didn't show any issues.
But on Logstash I see the connection was closed,
**[2018-01-19T18:21:47,080][INFO ][org.logstash.beats.BeatsHandler] [local: 0.0.0.**
**0:5044, remote: undefined] Exception: An existing connection was forcibly closed**
** by the remote host,**
filebeat.yml
filebeat.prospectors:
- type: log
enabled: true
paths:
#- /var/log/*.log
- c:\fileuploads\*
name: Filebeat1
output.logstash:
# The Logstash hosts
hosts: ["logstash:5044"]
protocol: "https"
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
ssl.certificate_authorities: ["c:\\certs\\ca\\ca.crt"]
# Certificate for SSL client authentication
ssl.certificate: "c:\\certs\\filebeat1\\filebeat1.crt"
# Client Certificate Key
ssl.key: "c:\\certs\\filebeat1\\filebeat1.key"
logstash beats config,
input {
beats {
port => 5044
codec => "json"
ssl => true
ssl_certificate_authorities => ["D:\logstash-6.1.1\config\ca\ca.crt"]
ssl_certificate => "D:\logstash-6.1.1\config\logstash\logstash.crt"
ssl_key => "D:\logstash-6.1.1\config\logstash\logstash.key"
}
}
any ideas?