# How to configure Filebeat and Logstash 8.1 with TLS

**URL:** <https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [April 4, 2022, 3:19pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534 "2022-04-04T15:19:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fim/32/90645_2.png) [@fim](https://discuss.elastic.co/u/fim)\
**Post date:** [April 4, 2022, 3:19pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534/1 "2022-04-04T15:19:24Z")

</div>

We are trying to secure the connectivity between Filebeat 8.1.1 \>\> Logstash 8.1.1 \>\> Elasticsearch 8.1.1  
The documentation says we have to add a .p12 certificate in the output section of filebeat.yml and logstash pipeline.

But the built-in Elasticsearch CA doesn't offer a .p12 certificate.

We even do not know the Elasticsearch CA password in order to convert/create a .p12 certificate.

Any help is much appreciated.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 5, 2022, 2:45am UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534/2 "2022-04-05T02:45:13Z")

</div>

Both [Configure SSL | Filebeat Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) and [Secure communication with Elasticsearch | Filebeat Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/securing-communication-elasticsearch.html) describe how to do this with PEM encoded certificates

You basically need:

```auto
output.elasticsearch:
  hosts: ["https://myEShost:9200"]
  username: "filebeat_writer" 
  password: "YOUR_PASSWORD" 
  ssl.certificate_authorities: /path/to/http_ca.crt

```

For more details, check the referenced docs

HTH

---

<div class="post-metadata">

**Author:** ![fim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fim/32/90645_2.png) [@fim](https://discuss.elastic.co/u/fim)\
**Post date:** [April 10, 2022, 1:15pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534/3 "2022-04-10T13:15:01Z")

</div>

We were successful implementing the communication between filebeat \<\> logstash.

But after hours of troubleshooting (since we do not get any errors neither in the logstash log nor in the Elasticsearch log, we still face issue with the connectivitiy between logstash \<\> Elasticsearch.

We followed this documentation:

> **[Secure your connection to Elasticsearch | Logstash Reference \[8.1\] | Elastic](https://www.elastic.co/guide/en/logstash/current/ls-security.html#es-sec-plugin)**

We do not get it, which option we should choose.

OPTION 1

```auto
output {
  elasticsearch {
    hosts => ["https://myhost.local] 
    cacert => '/etc/logstash/config/certs/ca.crt'
    user => logstash_internal
    password => x-pack-test-password
  }
}

```

OPTION 2

```auto
output {
  elasticsearch {
    hosts => ["https://myhost.local] 
    ssl => true
    cacert => '/path/to/cert.pem' 
    user => logstash_internal
    password => x-pack-test-password
  }
}

```

In Option 1, the output section of the pipelines.conf a ca.crt is required, but how do we get a .crt format? We just have .pem available from the default Elasticsearch CA?

Option 2 didn't work as well.

Additionally, is the basic authentication optional or required when using the certificate?

Could somebody share the minimum requirement of a conf file when sending data from logstash to Elasticsearch including TSL encryption?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2022, 1:16pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-8-1-with-tls/301534/4 "2022-05-08T13:16:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.