# How to authenticate Logstash output to a secure Elasticsearch URL (version 5.6.5)

**URL:** <https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500>\
**Category:** Logstash\
**Created:** [March 5, 2018, 12:01pm UTC](https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500 "2018-03-05T12:01:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![loganathan001](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loganathan001/32/25101_2.png) [@loganathan001](https://discuss.elastic.co/u/loganathan001)\
**Post date:** [March 5, 2018, 12:01pm UTC](https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500/1 "2018-03-05T12:01:33Z")

</div>

I am using Logstash 5.6.5. So far used elasticsearch (version 5.6.5) output with HTTP protocol and no authentication. Now Elasticsearch is being secured using basic authentication (user/password) and CA certified HTTPS URL. I don't have any control over the elasticsearch server. I just use it to output to from Logstash.

Now when I try to configure the HTTPS URL of elasticsearch with basic authentication, it fails to create the pipeline.

**Output Configuration**

```
output { 
 elasticsearch {
   hosts => ["https://myeslasticsearch.server.io"]
   user => "esusername"
   password => "espassword"
   ssl => true
 }
}

```

**Errors**

```
 1. Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0x50aa9200
 2. Pipeline aborted due to error {:exception=>#<URI::InvalidComponentError: bad component(expected user component):

```

How to fix this? I notice that there is a field called `cacert` which requires some PEM file. But I am not sure what to put there since the Elasticsearch server is using a CA certified SSL not a self-signed one.

**Addtional question:** I don't have any xpack installed. Is 'xpack' required to be purchased for HTTPS output to Elasticsearch from Logstash?

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [March 5, 2018, 9:45pm UTC](https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500/2 "2018-03-05T21:45:10Z")

</div>

try making ssl\_certification\_verification false as default value is true.

```
 elasticsearch {
             hosts => ["es:9200"]
              user => "xxxx"
              password => "xxxx"
              ssl => true
              ssl_certificate_verification => false
              index => "indexname"     
        }

```

if you are using any truststore certs mention paths in output:

```
         elasticsearch {
                 hosts => ["<es>:9200"]
                  user => "xxxx"
                  password => "xxxx"
                  ssl => true
                  ssl_certificate_verification => false
                  truststore => "<path>"
                  truststore_password => "<password>"
                 index => "<indexname>"     
            }
```

---

<div class="post-metadata">

**Author:** ![loganathan001](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loganathan001/32/25101_2.png) [@loganathan001](https://discuss.elastic.co/u/loganathan001)\
**Post date:** [March 6, 2018, 8:39am UTC](https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500/3 "2018-03-06T08:39:28Z")

</div>

I found the root cause of the issue. There were three things to fix:

1. The logstash version I tested with was wrong 5.5.0. I downloaded the correct version to match with Elasticsearch Version 5.6.5.

2. The host I used was running on 443 port. When I didn't specify the port as below logstash appends 9200 with it.  
`hosts => ['https://my.es.server.com']`  
Below configuration corrected the port used by logstash.  
`hosts => ['https://my.es.server.com:443']`

3. I was missing proxy connection settings.  
`proxy => 'http://my.proxy.com:80'`

Overall settings that worked.

```
output {
	elasticsearch {
	   hosts => ['https://my.es.server.com:443']
	   user => 'esusername'
	   password => 'espassword'
	   proxy => 'http://my.proxy:80'
	   index => "my-index-%{+YYYY.MM.dd}"
	}
}

```

No need for 'ssl' field.

Also **NO need for 'xpack'** installation for this requirement.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2018, 8:51am UTC](https://discuss.elastic.co/t/how-to-authenticate-logstash-output-to-a-secure-elasticsearch-url-version-5-6-5/122500/4 "2018-04-03T08:51:26Z")

</div>

Closed on April 3, 2018, 8:51am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.