# Filebeat

**URL:** <https://discuss.elastic.co/t/filebeat/62596>\
**Category:** Beats\
**Created:** [October 10, 2016, 5:08am UTC](https://discuss.elastic.co/t/filebeat/62596 "2016-10-10T05:08:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\
**Post date:** [October 10, 2016, 5:08am UTC](https://discuss.elastic.co/t/filebeat/62596/1 "2016-10-10T05:08:42Z")

</div>

/etc/filebeat/filebeat.yml

filebeat:  
prospectors:  
-  
paths:  
- /var/log/auth.log  
- /var/log/syslog  
# - /var/log/\*.log

```
  input_type: log

  document_type: syslog

```

registry\_file: /var/lib/filebeat/registry

output:  
logstash:  
hosts: ["10.33.30.76:5044"]  
bulk\_max\_size: 1024

```
tls:
  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
  certificate_key: ["/etc/pki/tls/private/logstash-forwarder.key"]

```

shipper:

logging:  
files:  
rotateeverybytes: 10485760 # = 10MB

/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -e -v

ERR Failed to publish events caused by: read tcp 10.33.255.24:55308-\>10.33.30.76:5044: i/o timeout  
INFO Error publishing events (retrying): read tcp 10.33.255.24:55308-\>10.33.30.76:5044: i/o timeout  
ERR SSL client failed to connect with: read tcp 10.33.30.73:34521-\>10.33.30.76:5044: i/o timeout

I need anybody's help.

How can I create certificate

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 10, 2016, 7:34am UTC](https://discuss.elastic.co/t/filebeat/62596/2 "2016-10-10T07:34:00Z")

</div>

Did you follow the docs here? [https://www.elastic.co/guide/en/beats/filebeat/current/configuring-tls-logstash.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-tls-logstash.html)

Please use descriptive titles for your discuss topics and format the code parts with 3 ticks ` before and after to make it better readable.

---

<div class="post-metadata">

**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\
**Post date:** [October 13, 2016, 6:30am UTC](https://discuss.elastic.co/t/filebeat/62596/3 "2016-10-13T06:30:10Z")

</div>

I created certificat by this command

openssl req -x509 -days 365 -batch -nodes -newkey rsa:2048 -keyout /etc/ssl/logstash-forwarder.key -out /etc/ssl/logstash-forwarder.crt

I see  
logstash-forwarder.crt and logstash-forwarder.key certificates.

I don't understand where root/ca.pem certificat?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2016, 5:08am UTC](https://discuss.elastic.co/t/filebeat/62596/4 "2016-10-31T05:08:58Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.