Filebeat Misp Module Ceritifcate Problem

Hi all,

I am trying to get data from MISP using filebeat but i am having trouble making filebeat work because it doesn't want to establish connection to MISP due to it being self signed.

Things i have tried:

In Filebeat.yml
ssl.verification_mode: "none"
This did not do anything.

In Filebeat Misp Module:
var.ssl.verification_mode: "none" or var.ssl.verification_mode: none

Gives the error:

2020-04-30T09:39:53.962+0700    ERROR   instance/beat.go:933    Exiting: (assert) value of type 'string' not convertible into unsupported go type 'tlscommon.Config' accessing 'ssl'
Trace:goroutine 1 [running]:
runtime/debug.Stack(0x32ef81f, 0xb, 0xc000936078)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x9d, 0xc0000e90b0, 0xc0002b2460, 0x6b, 0x52, 0xc0007bd498)
        /go/src/ +0x66, 0x378b660, 0xc000448fc0, 0x37a75c0, 0x31a8040, 0x2e7dea0, 0x0)
        /go/src/ +0x232, 0x0, 0x0, 0x0, 0x0, 0x378b660, 0xc000448fc0, 0x37a75c0, 0x31a8040, 0x18304db, ...)
        /go/src/ +0x89c, 0x0, 0x0, 0x0, 0x0, 0x378b660, 0xc000448fc0, 0x37a75c0, 0x2f8fea0, 0x37a75c0, ...)
        /go/src/ +0x5fb, 0x0, 0x0, 0x0, 0x0, 0x37a75c0, 0x2f8fea0, 0x378b660, 0xc000448fc0, 0xc0008e7d70, ...)
        /go/src/ +0x990, 0x0, 0x0, 0x0, 0x0, 0x2f8fea0, 0xc00025dda8, 0x196, 0x378b660, 0xc000448fc0, ...)
        /go/src/ +0xfbf, 0xc00015fb80, 0x0, 0x0, 0x0, 0x0, 0x2d0c320, 0x3, 0x2f8fea0, 0xc00025dda8, ...)
        /go/src/ +0x248, 0x31fba20, 0xc00025dce0, 0x199, 0xc00064f680, 0x0, 0x0)
        /go/src/ +0x5e0, 0x2f4b640, 0xc00025dce0, 0x16, 0xc00064f680, 0x70, 0x31fba20)
        /go/src/ +0x3fb*Config).Unpack(0xc00064f680, 0x2f4b640, 0xc00025dce0, 0xc000568a00, 0x4, 0x4, 0x10, 0xc000936c28)
        /go/src/ +0x103*Config).Unpack(...)
        /go/src/, 0x37135a0, 0xc0007e4dc0, 0xc000630000, 0x72, 0x72, 0xc0008410e0, 0xc000840000, 0x0, 0x0, ...)
        /go/src/ +0xe5, 0x37135a0, 0xc0007e4dc0, 0xc000840000, 0xc000630000, 0x72, 0x72, 0x0, 0x0, 0x2f48798, ...)
        /go/src/ +0x392*Factory).Create(0xc000550000, 0x3733c20, 0xc0008dadc0, 0xc00099fa70, 0x0, 0x0, 0x4, 0x0, 0x0)
        /go/src/ +0x2af*Reloader).Check(0xc000252cc0, 0x36e38a0, 0xc000550000, 0xc000252cc0, 0xc00061e000)
        /go/src/ +0x2e6*Crawler).Start(0xc0006621b0, 0x3733c20, 0xc0008dadc0, 0xc0002527e0, 0x0, 0xc0002bb560, 0xc0001a7d90, 0xc00099a000, 0xc0002527e0, 0x0)
        /go/src/ +0x428*Filebeat).Run(0xc0007038c0, 0xc000607440, 0x0, 0x0)
        /go/src/ +0xa9d*Beat).launch(0xc000607440, 0x32eab08, 0x8, 0x32eab08, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, ...)
        /go/src/ +0x700, 0x8, 0x32eab08, 0x8, 0x0, 0x0, 0xc000b17c58, 0x33f0e98, 0x0, 0x0)
        /go/src/ +0x56b, 0x8, 0x32eab08, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
        /go/src/ +0x148, 0xc0006fd830, 0x0, 0x9)
        /go/src/ +0x9d*Command).execute(0xc000289680, 0xc00004e0b0, 0x9, 0x9, 0xc000289680, 0xc00004e0b0)
        /go/src/ +0x285*Command).ExecuteC(0xc000289680, 0x0, 0xd6e00, 0xc000116058)
        /go/src/ +0x2c9*Command).Execute(...)
        /go/src/ +0x2f

Thank You.

In the latest filebeat it shows how to do this as follows:

    # You can also pass SSL options. For example:
    var.ssl: |-
        verification_mode: none

Not sure if this is how you have it configured, does seem to work for me.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.