# Filebeat with SASL authentication

**URL:** <https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616>\
**Category:** Beats\
**Created:** [October 13, 2025, 2:31am UTC](https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616 "2025-10-13T02:31:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thirupathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thirupathi/32/145431_2.png) [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\
**Post date:** [October 13, 2025, 2:31am UTC](https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616/1 "2025-10-13T02:31:59Z")

</div>

{"log.level":"debug","@timestamptimestamp":"2025-10-09T05:53:58.464-0400","log.logger":"registrar","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/registrar.(\*Registrar).commitStateUpdates","file.name":"registrar/registrar.go","file.line":203},"message":"Registry](http://github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).commitStateUpdates%22,%22file.name%22:%22registrar/registrar.go%22,%22file.line%22:203%7D,%22message%22:%22Registry) file updated. 2 active states.","service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level"@timestamp"info","@timestamp":"2025-10-09T05:54:00.459-0400","log.logger":"publisher\_pipeline\_output","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/publisher/pipeline.(\*netClientWorker).run","file.name":"pipeline/client\_worker.go","file.line":138},"message":"Connecting](http://github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run%22,%22file.name%22:%22pipeline/client_worker.go%22,%22file.line%22:138%7D,%22message%22:%22Connecting) to kafka(10.42.41.55:19094)","service.name":"filebeat","ecs.version":"1.6.0"}

{"lo@timestamp.level":"debug","@timestamp":"2025-10-09T05:54:00.459-0400","log.logger":"kafka","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/outputs/kafka.(\*client).Connect","file.name":"kafka/client.go","file.line":120},"message":"connect:](http://github.com/elastic/beats/v7/libbeat/outputs/kafka.(*client).Connect%22,%22file.name%22:%22kafka/client.go%22,%22file.line%22:120%7D,%22message%22:%22connect:) [10.42.41.55:19094]","service.name":"filebeat","ecs.version":"1.6@timestamp0"}

{"log.level":"info","@timestamp":"2025-10-09T05:54:00.459-0400","log.logger":"publisher\_pipeline\_output","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/publisher/pipeline.(\*netClientWorker).run","file.name":"pipeline/client\_worker.go","file.line":146},"message":"Connection](http://github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run%22,%22file.name%22:%22pipeline/client_worker.go%22,%22file.line%22:146%7D,%22message%22:%22Connection) to kafka(10.42.41.55:19094) established","service.name":"filebeat","ecs.versi@timestampn":"1.6.0"}

{"log.level":"error","@timestamp":"2025-10-09T05:54:00.461-0400","log.logger":"kafka","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/outputs/kafka.(\*client).errorWorker","file.name":"kafka/client.go","file.line":338},"message":"Kafka](http://github.com/elastic/beats/v7/libbeat/outputs/kafka.(*client).errorWorker%22,%22file.name%22:%22kafka/client.go%22,%22file.line%22:338%7D,%22message%22:%22Kafka) (topic=npc-raw-msg): kafka: couldn't fetch broker metadata (check that your client and broker are using the same encryption and authentication settings)","service.name":"filebeat","e@timestamps.version":"1.6.0"}

^C{"log.level":"info","@timestamp":"2025-10-09T05:54:04.050-0400","log.logger":"service","log.origin":{"function":"[github.com/elastic/elastic-agent-libs/service.HandleSignals.func1","file.name":"service/service.go","file.line":52},"message":"Received](http://github.com/elastic/elastic-agent-libs/service.HandleSignals.func1%22,%22file.name%22:%22service/service.go%22,%22file.line%22:52%7D,%22message%22:%22Received) signal "interrupt", stopping","service.name":"fi@timestampebeat","ecs.version":"1.6.0"}

{"log.level":"debug","@timestamp":"2025-10-09T05:54:04.050-0400","log.logger":"publisher","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/publisher/pipeline.(\*Pipeline).Close","file.name":"pipeline/pipeline.go","file.line":167},"message":"close](http://github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*Pipeline).Close%22,%22file.name%22:%22pipeline/pipeline.go%22,%22file.line%22:167%7D,%22message%22:%22close) pipeline","service.@timestampame":"filebeat","ecs.version":"1.6.0"}

{"log.level":"debug","@timestamp":"2025-10-09T05:54:05.051-0400","log.logger":"kafka","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/outputs/kafka.(\*client).Close","file.name":"kafka/client.go","file.line":141},"message":"closed](http://github.com/elastic/beats/v7/libbeat/outputs/kafka.(*client).Close%22,%22file.name%22:%22kafka/client.go%22,%22file.line%22:141%7D,%22message%22:%22closed) kafka client",@timestampservice.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"debug","@timestamp":"2025-10-09T05:54:05.051-0400","log.logger":"publisher","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/publisher/pipeline.(\*queueReader).run","file.name":"pipeline/queue\_reader.go","file.line":54},"message":"pipeline](http://github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*queueReader).run%22,%22file.name%22:%22pipeline/queue_reader.go%22,%22file.line%22:54%7D,%22message%22:%22pipeline) event consumer queue reade@timestamp: stop","service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"error","@timestamp":"2025-10-09T05:54:05.051-0400","log.logger":"kafka","log.origin":{"function":"[github.com/elastic/beats/v7/libbeat/outputs/kafka.(\*client).errorWorker","file.name":"kafka/client.go","file.line":338},"message":"Kafka](http://github.com/elastic/beats/v7/libbeat/outputs/kafka.(*client).errorWorker%22,%22file.name%22:%22kafka/client.go%22,%22file.line%22:338%7D,%22message%22:%22Kafka) (topic=npc-raw-msg): kafka: couldn't fetch broker metadata (check that your client and broker are using the same encryption and authenti@timestampation settings)","service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"error","@timestamp":"2025-10-09T05:54:0

output.kafka:

hosts: ["xx.xx.xx:19094"]

topic: 'npc-raw-msg'

key: '%{[UUID]}'

codec.format:

string: '%{[message]}'  
partition.round\_robin:

reachable\_only: false  
required\_acks: 1

compression: gzip

max\_message\_bytes: 1000000

close\_inactive: 10m

sasl.mechanism: SCRAM-SHA-512

sasl.username: "test-user-ranjith"

sasl.password: "xSBWc2w6NmkiPi4+YyBs"

security.protocol: SASL\_PLAINTEXT

logging.level: debug

logging.to\_files: true

logging.files:

path: /var/log/filebeat-kafka

name: filebeat

keepfiles: 7

permissions: 0644

---

<div class="post-metadata">

**Author:** ![Thirupathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thirupathi/32/145431_2.png) [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\
**Post date:** [October 13, 2025, 11:06am UTC](https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616/2 "2025-10-13T11:06:22Z")

</div>

this is the issue am getting using above configuration (topic=npc-raw-msg): kafka: couldn't fetch broker metadata (check that your client and broker are using the same encryption and authenti@timestampation settings)","service.name":"filebeat","ecs.version":"1.6.0"}