# Filebeat to Logstash via reverse proxy

**URL:** <https://discuss.elastic.co/t/filebeat-to-logstash-via-reverse-proxy/199760>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 17, 2019, 6:02am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-via-reverse-proxy/199760 "2019-09-17T06:02:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaiganesh06](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@jaiganesh06](https://discuss.elastic.co/u/jaiganesh06)\
**Post date:** [September 17, 2019, 6:02am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-via-reverse-proxy/199760/1 "2019-09-17T06:02:26Z")

</div>

Hi All,  
I am new here. We have configured filebeat to logstash via SSL in our test environment. In our production environment, we are planning for an architecture similar to below:

Filebeat \> Secure Apache based reverse proxy \> Logstash \> ES \> Kibana

We are planning to use version 7.3.x.  
I have few queries here,

1. When I read through few posts, I find communication through http based reverse proxy is not feasible between filebeat and logstash. Only SOCKS5 proxy is allowed. Is this same for 7.3.x as well?
2. Apart from SSL, does 7.3.x filebeat supports user authenication to logstash, similar to elasticsearch?

Note - We are not using X-Pack as of now.

Thanks  
Jai.

---

<div class="post-metadata">

**Author:** ![jaiganesh06](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@jaiganesh06](https://discuss.elastic.co/u/jaiganesh06)\
**Post date:** [September 18, 2019, 5:17am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-via-reverse-proxy/199760/2 "2019-09-18T05:17:42Z")

</div>

Update to above post -  
I have apache 2.4 reverse proxy between Filebeat and logstash. Disabled SSL now. I get below error in filebeat log

| 2019-09-18T10:44:52.287+0530 | INFO | pipeline/output.go:95 | Connecting to backoff(async(tcp://XXX:80)) |
| --- | --- | --- | --- |
| 2019-09-18T10:44:52.582+0530 | INFO | pipeline/output.go:105 | Connection to backoff(async(tcp://XXX:80)) established |
| 2019-09-18T10:44:52.933+0530 | ERROR | logstash/async.go:256 | Failed to publish events caused by: lumberjack protocol error |
| 2019-09-18T10:44:52.938+0530 | ERROR | logstash/async.go:256 | Failed to publish events caused by: client is not connected |
| 2019-09-18T10:44:54.136+0530 | ERROR | pipeline/output.go:121 | Failed to publish events: client is not connected |

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2019, 5:17am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-via-reverse-proxy/199760/3 "2019-10-16T05:17:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
