Get info of SSL client certificate used for beats in logs send to Logstash


I would like to have the CN of the certificate that is used to connect from winlogbeat/filebeat to logstash as seperate field in logstash/elastic. Does anybody know if this is possible?

I cannot find this anywhere in the documentation.

Logstash adds the CN under the @metadata. You'll need to add a filter to copy the value into the event given that @metadata does not get written to Elasticsearch.

See Beats input plugin | Logstash Reference [8.3] | Elastic for a complete list of available fields.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.