# Filebeat encrypted communication to Logstash

**URL:** <https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739>\
**Category:** Beats\
**Created:** [July 3, 2020, 6:49am UTC](https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739 "2020-07-03T06:49:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 3, 2020, 6:49am UTC](https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739/1 "2020-07-03T06:49:44Z")

</div>

Dears,

I have to enable SSL/TLS in Filebeat configuration to encrypt communication to Logstash.  
Right now my ELK cluster use SSL/TLS configuration between nodes with self-signed certificates. Logstash is started on each ELK node.  
Certs were generated on the first node of ELK cluster through:  
bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /tmp/certs/certs.zip

File instance.yml included list of ELK nodes. Command elasticsearch-certutil generated certs for each node like this:  
ca.crt  
node.crt  
node01.key

The question is how to generate certs for machines where filebeat is installed?  
Do you have any experience with such configuration?

Best Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [July 3, 2020, 7:03am UTC](https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739/2 "2020-07-03T07:03:39Z")

</div>

Hello Daniel,

Do you want to encrypt the communication or do you want to use client authentication? For Encryption, you do not need certificates on the filebeat machines. Just configure filebeat to use SSL and where to find the certificate authorities:

```auto
output.logstash:
  # The Logstash hosts
  hosts: ["host:5043"]
  ssl.enabled: true
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/path/to/intermediateCa.crt", "/path/to/rootCa.crt"]

```

In the Logstash pipeline configure the SSL too(Be aware that the key must be pkcs8 as far as I know):

```auto
input {
    beats {
        host => "host"
        port => 5043
        ssl => true
        ssl_certificate => "/path/to/serverCert.crt"
        ssl_certificate_authorities => ["/path/to/intermediateCa.crt", "/path/to/rootCa.crt"]
        ssl_key => "/path/to/private.key.pkcs8"
        ssl_key_passphrase => "${input.ssl_key_passphrase}"
    }
}

```

Add the passphrase to the LogStash keystore and you are good to go.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 3, 2020, 7:10am UTC](https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739/3 "2020-07-03T07:10:50Z")

</div>

> [@Wolfram\_Haussig](#):
>
> Wolfram

Hello Wolfram,

Thank you for the quick reply. I want to turn on traffic authentication between Filebeat and Logstash.

Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2020, 9:10am UTC](https://discuss.elastic.co/t/filebeat-encrypted-communication-to-logstash/239739/4 "2020-07-31T09:10:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.