The full log is not telling much either. I agree that it is from your last successful execution. Are you using a different configuration file that contain this ssl.certificate_authorities setting? If so can you simply upload the file to uploadfiles.io and paste link here?
I am removing comments when i try using ssl.certificate_authorities and when it does not work, I apply comment to that line and restart filebeat. I don't have a seperate file that uses ssl.certificate_authorities.
Can you please upload the file to uploadfiles.io so I can take a look?
here is the link to my file.
Hope it helps.
Can you try setting C:\\Program Files\\filebeat\\logstash.crt (with double slashes) instead?
That worked but it generates a new error saying this :
"ERR Connecting error publishing events (retrying): x509: cannot validate certificate for 172.16.1.84 because it doesn't contain any IP SANs"
So now filebeat is working and this is an issue with the certificate itself. You need to verify with whoever issued it.
That certificate is the same one that we generate while installing logstash using "cd /etc/logstash/
openssl req -subj /CN=elk-master -x509 -days 3650 -batch -nodes -newkey rsa:4096 -keyout logstash.key -out logstash.crt" this command. Is there any issue with this command?
I am not really sure. Maybe @json can evaluate that?
i even tried adding "SAN = ip" into the v3_ca but it is not working
Update: I regenerated the certificate with
openssl req -subj /CN=elk-master -x509 -days 3650 -batch -nodes -newkey rsa:4096 -keyout logstash.key -out logstash.crt
and replacing CN=IP of the machine that runs logstash. now everything works with ssl in filebeat config file.
Thanks a lot @thiago ..
I am glad your problem is solved! 
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.