# Fresh ELK install 8.4.3. Logstash problem
**URL:** https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670
**Category:** Logstash
**Created:** [October 28, 2022, 9:41am UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670 "2022-10-28T09:41:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Xgraver1](https://discuss.elastic.co/u/Xgraver1)
#### Post date: [October 28, 2022, 9:41am UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670/1 "2022-10-28T09:41:13Z")
Hello
Could use some help with fresh ELK installation on premises. I installed Elasticstack and Kibana with mostly default configuration. In Elasticstack conf i changed Data path and uncommented host and port settings. In Kibana i uncommented host, port and publicBaseUrl.
When starting Elasticstack i as given firstime user and token. When starting Kibana for the first time i got to insert that token and login in worked. So far so good.
Then i installed Logstash and made simple pipe config, where input is syslog and output is Elasticstack. But i get errors:
Logstash:
`[2022-10-28T12:38:03,467][INFO][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"x.x.x.x:9200 failed to respond", :exception=>Manticore::ClientProtocolException, :cause=>#}`
Elasticsearch:
`[2022-10-28T12:37:58,446][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [ELK] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/x.x.x.x:9200, remoteAddress=/x.x.x.x:54377}`
It seems like authentication problem. When i tested with Elasticsearch security turned off it started sending fine but that also removes users login part that i like.
What do i need to add in logstash to make it work with authentication.
i tryed to change:
```auto
output {
elasticsearch {
hosts => ["x.x.x.x:9200"]
}
}
```
hosts to include http / https aswell, dident change anything.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 28, 2022, 1:01pm UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670/2 "2022-10-28T13:01:39Z")
> [@Xgraver1](#):
>
> It seems like authentication problem.
It is not authentication, authentiacation errors from elasticsearch will return a `401` or `403`, your Logstash can't even connect to Elasticsearch yet.
> [@Xgraver1](#):
>
> [2022-10-28T12:37:58,446][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [ELK] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/x.x.x.x:9200, remoteAddress=/x.x.x.x:54377}
This means that you have something sending data to your Elasticsearch instance using `http` while it expects `https`.
In your Logstash output you need to use `hosts => ["https://ip:9200"]`.
Change it to https and share both the Logstash logs and Elastiscearch logs.
---
### Author:  [@Xgraver1](https://discuss.elastic.co/u/Xgraver1)
#### Post date: [October 31, 2022, 6:06am UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670/3 "2022-10-31T06:06:50Z")
When i added:
```auto
hosts => ["https://x.x.x.x:9200"]
ssl => true
cacert => 'C:\logstash-8.4.3\config\certs\http_ca.crt'
user => 'logstash_internal'
password => 'xxxx'
```
Then it started working.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 28, 2022, 6:07am UTC](https://discuss.elastic.co/t/fresh-elk-install-8-4-3-logstash-problem/317670/4 "2022-11-28T06:07:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.