# Filebeat to logstash not working

**URL:** <https://discuss.elastic.co/t/filebeat-to-logstash-not-working/191926>\
**Category:** Logstash\
**Created:** [July 24, 2019, 12:10am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-not-working/191926 "2019-07-24T00:10:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nila](https://avatars.discourse-cdn.com/v4/letter/n/b2d939/32.png) [@nila](https://discuss.elastic.co/u/nila)\
**Post date:** [July 24, 2019, 12:10am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-not-working/191926/1 "2019-07-24T00:10:49Z")

</div>

I have configured ELK cluster basic version and enabled TLS/SSL. it works fine until logstash. The communication between filebeat to logstash is not working. I dont see any errors in filebeat. Please help if SSL configuration below is right.

Here is my configuration:

filebeat:

filebeat.inputs:

- type: log  
close\_inactive: 10m

output.logstash:  
hosts: ["[logstash.com:5033](http://logstash.com:5033)"]  
ssl.certificate\_authorities:  
- /app1/filebeat/config/certs/ca.crt

Filebeat trace:  
"filebeat":{"harvester":{"open\_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0},"reloads":3}

## Logstash config: logstash.yml

node.name: logstash.local  
#path.config: /usr/share/logstash/pipeline-config/\*.conf  
xpack.monitoring.enabled: true  
xpack.monitoring.elasticsearch.username: logstash\_system  
xpack.monitoring.elasticsearch.password: 'pwd'  
xpack.monitoring.elasticsearch.hosts: ["[https://es01.com:9200](https://es01.com:9200)" ]  
xpack.monitoring.elasticsearch.ssl.certificate\_authority: /usr/share/logstash/config/certs/ca.crt

## Pipeline config:

input {  
beats {  
port =\>5033

```
            ssl => true
            ssl_key => '/usr/share/logstash/config/certs/logstash.pkcs8.key'
            ssl_certificate => '/usr/share/logstash/config/certs/logstash.crt'
             }

```

}  
filter {  
}  
output {  
if [fields][log\_type] == "APP\_RP\_AMS1" {  
elasticsearch {  
hosts =\> ["[https://es01.flex.com:9200](https://es01.flex.com:9200)","[https://es02.flex.com:9200](https://es02.flex.com:9200)","[https://es03.flex.com:9200](https://es03.flex.com:9200)"]  
index =\> "rp\_ams1\_log-%{+YYYY.MM.dd}"  
cacert =\> '/usr/share/logstash/config/certs/ca.crt'  
user =\> 'logstash\_writer'  
password =\> 'pwd'  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2019, 12:10am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-not-working/191926/2 "2019-08-21T00:10:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.