# How to ask Elastic Defend to use Logstash as output?

**URL:** <https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922>\
**Category:** Elastic Security\
**Created:** [June 24, 2024, 6:00am UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922 "2024-06-24T06:00:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevinlin](https://avatars.discourse-cdn.com/v4/letter/k/57b2e6/32.png) [@kevinlin](https://discuss.elastic.co/u/kevinlin)\
**Post date:** [June 24, 2024, 6:00am UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922/1 "2024-06-24T06:00:07Z")

</div>

I have created:

- Fleet output (Name: OutLogstash, Type: Logstash, with Server SSL CA, Client SSL cert, Client SSL key)
- Fleet Agent policy (Name: WinAgentPolicy, Output for integrations: OutLogstash )
- In WinAgentPolicy, add Windows AD

Unfortunately, Agent unhealthy cause by Elastic Defend - Elasticsearch connection failure

How to ask Elastic Defend to use Logstash as output?

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [June 24, 2024, 12:36pm UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922/2 "2024-06-24T12:36:42Z")

</div>

As a first step run from elevated command line `elastic-endpoint test output`

```auto
"C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe" test output

```

or

```auto
sudo /Library/Elastic/Endpoint/elastic-endpoint test output

```

or

```auto
/opt/Elastic/Endpoint/elastic-endpoint test output

```

and please do not forget to indicate your stack version when asking questions.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 24, 2024, 12:38pm UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922/3 "2024-06-24T12:38:49Z")

</div>

Also, what is the license you are using? A paid license or the free basic license?

Do you have any other fleet output configured and being used?

---

<div class="post-metadata">

**Author:** ![kevinlin](https://avatars.discourse-cdn.com/v4/letter/k/57b2e6/32.png) [@kevinlin](https://discuss.elastic.co/u/kevinlin)\
**Post date:** [June 25, 2024, 7:48am UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922/4 "2024-06-25T07:48:38Z")

</div>

> [@lesio](#):
>
> `"C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe" test output`

This is really embarrassing. The test output says:  
Logstash server: 172.19.171.160:5044  
Status: OpenSSL library call failed

Agent become healthy after I re-paste Server SSL CA, Client SSL cert and Client SSL key in Logstash output again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2024, 7:49am UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922/5 "2024-07-23T07:49:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.