EDIT: I'm running version 5.3 of everything.
I'm currently trying to get my filebeat to logstash connections using SSL, but I keep running into the error:
2017/04/05 16:42:16.045679 sync.go:53: DBG connect
2017/04/05 16:42:16.108391 single.go:140: ERR Connecting error publishing events (retrying): remote error: tls: handshake failure
2017/04/05 16:42:16.108424 single.go:156: DBG send fail
I can ship logs without SSL enabled fine. And I've confirmed that the connections are reaching the Logstash machine with SSL configured, just not actually able to establish a functioning connection. I can also create an openssl client connection from the beats machine to the logstash machine on port 5044 and the SSL certs and connection all checkout fine.
I have Logstash, Elasticsearch and Kibana all communicating via ssl connections just fine, but Filebeats just won't cooperate. My current filebeats config is:
name: "shipper"
filebeat:
prospectors:
- input_type: log
tags: [ "mylogs" ]
tail_files: true
paths:
- /path/to/logs
- /path/to/logs
- /path/to/logs
output:
logstash:
hosts: [ "logstash.host:5044" ]
compression_level: 1
ssl:
certificate_authorities: [ "/path/to/ca.crt" ]
logging:
level: warning
to_files: true
to_syslog: false
files:
path: /path/to/logs
name: filebeats.log
keepfiles: 7
My logstash input on the other end is:
input {
beats {
host => "xxx.xxx.xxx.xxx"
port => 5044
ssl => true
ssl_certificate_authorities => [ "/path/to/ca.crt" ]
ssl_certificate => "/path/to/logstash.crt"
ssl_key => "/path/to/logstash.pkcs8"
}
}