# Filebeat can't connect to elastic - Cert unknown authority

**URL:** <https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 26, 2023, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848 "2023-10-26T15:12:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![phant0m\_phr3ak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phant0m_phr3ak/32/124808_2.png) [@phant0m\_phr3ak](https://discuss.elastic.co/u/phant0m_phr3ak)\
**Post date:** [October 26, 2023, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848/1 "2023-10-26T15:12:46Z")

</div>

When trying to run "sudo filebeat setup -e" I get the below error about cert signed by unknown authority. I have not been able to figure this out. Any ideas what I am missing here?

```auto
Errors: [error connecting to Elasticsearch at https://localhost:9200: Get \"https://localhost:9200\": x509: certificate signed by unknown authority]","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://localhost:9200: Get "https://localhost:9200": x509: certificate signed by unknown authority]

```

Current filebeat.yml elastic output config.

```auto
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
        hosts: ["https://localhost:9200"]

        # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
username: "elastic"
password: "notmypassword"
ssl:
  enabled: true
  ca_trusted_fingerprint: "87EA9A3E1FDD05EB35742DE84D2AE6D3BD8B567DDDE14F4C608B4467C688AA41" 

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 26, 2023, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848/2 "2023-10-26T15:35:05Z")

</div>

> [@phant0m\_phr3ak](#):
>
> ```auto
> # ---------------------------- Elasticsearch Output ----------------------------
> output.elasticsearch:
> # Array of hosts to connect to.
> hosts: ["https://localhost:9200"]
> 
> # Protocol - either `http` (default) or `https`.
> #protocol: "https"
> 
> # Authentication credentials - either API key or username/password.
> #api_key: "id:api_key"
> username: "elastic"
> password: "notmypassword"
> ssl:
> enabled: true
> ca_trusted_fingerprint: "87EA9A3E1FDD05EB35742DE84D2AE6D3BD8B567DDDE14F4C608B4467C688AA41" 
> 
> ```

Not sure if that is typo or mean but that is not correct syntax etc the indentation needs to be correct try this...

```auto
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://localhost:9200"]
  username: "elastic"
  password: "notmypassword"
  ssl:
    enabled: true
    ca_trusted_fingerprint: "87EA9A3E1FDD05EB35742DE84D2AE6D3BD8B567DDDE14F4C608B4467C688AA41" 

```

If you have incorrect indenting / syntax in other places in any of the .yml files you will have issues

---

<div class="post-metadata">

**Author:** ![phant0m\_phr3ak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phant0m_phr3ak/32/124808_2.png) [@phant0m\_phr3ak](https://discuss.elastic.co/u/phant0m_phr3ak)\
**Post date:** [October 26, 2023, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848/3 "2023-10-26T17:24:21Z")

</div>

Thank you. Sorry for being such a noob.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2023, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-cert-unknown-authority/345848/4 "2023-11-23T19:24:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.