# How to connect Winlogbeat to Elasticsearch dockrized Cluster using SSL?

**URL:** <https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013>\
**Category:** Beats\
**Tags:** elastic-stack-security, docker, winlogbeat\
**Created:** [February 22, 2021, 12:37am UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013 "2021-02-22T00:37:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cyber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyber/32/84278_2.png) [@Cyber](https://discuss.elastic.co/u/Cyber)\
**Post date:** [February 22, 2021, 12:37am UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013/1 "2021-02-22T00:37:02Z")

</div>

For the past week I am trying to connect a Winlogbeat(Which is on my host machine) To an elasticsearch Cluster that I set up on an Ubuntu VM using dockers.

Following [this](https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-docker.html#get-started-docker) tutorial. (In the tutorial they don't explain how to connect a Beat)

My problem is with the SSL configuration (Of the Winlogbeat) I just can't get it right for some reason.

This is the error I get on the windows machine after running the setup command ( **.\winlogbeat.exe setup -e** ) -

```
2021-02-22T01:42:13.286+0200 ERROR instance/beat.go:971    
Exiting: couldn't connect to any of 
the configured Elasticsearch hosts. Errors: [error connecting to 
Elasticsearch at 
https://192.168.216.129:9200: Get "https://192.168.216.129:9200": 
x509: certificate signed by unknown 
authority]
Exiting: couldn't connect to any of the configured Elasticsearch 
hosts. Errors: [error connecting to 
Elasticsearch at https://192.168.216.129:9200: Get 
"https://192.168.216.129:9200": x509: certificate 
signed by unknown authority]

```

And on the Elasticsearch node I get this error -

```
es01 | "at 

```

io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.ja  
va:74) [netty-  
common-4.1.49.Final.jar:4.1.49.Final]",  
es01 | "at java.lang.Thread.run(Thread.java:832) [?:?]",  
es01 | "Caused by: javax.net.ssl.SSLHandshakeException: Received  
fatal alert: bad\_certificate",

I tried different methods without any success -

1. Using openssl to generate self-signed certificate for Winlogbeat (Using this [tutorial](https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309%22)). After that I tried to add the new CA I generated to the es\_certs volume and I tried to modify the elastic-docker-tls.yml so it will except the new CA (I failed at that).
2. I changed the instances.yml file by adding a winlogbeat section -

- name: winlogbeat dns: - ip: - 192.168.1.136

and ran docker-compose -f create-certs.yml run --rm create\_certs on a fresh install of the stack which  
resulted in the creation of a winlogbeat.crt and winlogbeat.key but still it didn't work.

1. I also tried to play with the verfication\_mode changing it to "none" but it didn't work either.

I don't know what else to try and I failed to find a good source that details the ssl configuration to beats to elk on a docker environment.

**This is the elastic-docker-tls.yml file:**

```auto
version: '2.2'

services:
  es01:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es01
    environment:
      - node.name=es01
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es02,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.license.self_generated.type=trial 
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true 
      - xpack.security.http.ssl.key=$CERTS_DIR/es01/es01.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es01/es01.crt
      - xpack.security.transport.ssl.enabled=true 
      - xpack.security.transport.ssl.verification_mode=certificate 
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es01/es01.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es01/es01.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data01:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    ports:
      - 9200:9200
    networks:
      - elastic

    healthcheck:
      test: curl --cacert $CERTS_DIR/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[$? == 52]]; then echo 0; else echo 1; fi
      interval: 30s
      timeout: 10s
      retries: 5

  es02:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es02
    environment:
      - node.name=es02
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=$CERTS_DIR/es02/es02.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es02/es02.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es02/es02.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es02/es02.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data02:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    networks:
      - elastic

  es03:
    image: docker.elastic.co/elasticsearch/elasticsearch:${VERSION}
    container_name: es03
    environment:
      - node.name=es03
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es02
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=$CERTS_DIR/es03/es03.key
      - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.http.ssl.certificate=$CERTS_DIR/es03/es03.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
      - xpack.security.transport.ssl.certificate=$CERTS_DIR/es03/es03.crt
      - xpack.security.transport.ssl.key=$CERTS_DIR/es03/es03.key
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data03:/usr/share/elasticsearch/data
      - certs:$CERTS_DIR
    networks:
      - elastic
  kib01:
    image: docker.elastic.co/kibana/kibana:${VERSION}
    container_name: kib01
    depends_on: {"es01": {"condition": "service_healthy"}}
    ports:
      - 5601:5601
    environment:
      SERVERNAME: localhost
      ELASTICSEARCH_URL: https://es01:9200
      ELASTICSEARCH_HOSTS: https://es01:9200
      ELASTICSEARCH_USERNAME: kibana_system
      ELASTICSEARCH_PASSWORD: CHANGEME
      ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES: $CERTS_DIR/ca/ca.crt
      SERVER_SSL_ENABLED: "true"
      SERVER_SSL_KEY: $CERTS_DIR/kib01/kib01.key
      SERVER_SSL_CERTIFICATE: $CERTS_DIR/kib01/kib01.crt
    volumes:
      - certs:$CERTS_DIR
    networks:
      - elastic
volumes:
  data01:
    driver: local
  data02:
    driver: local
  data03:
    driver: local
  certs:
    driver: local

networks:
  elastic:
    driver: bridge

```

**This is the Winlogbeat configuration**

```auto
###################### Winlogbeat Configuration Example ########################

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    processors:
      - script:
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

  - name: Windows PowerShell
    event_id: 400, 403, 600, 800
    processors:
      - script:
          lang: javascript
          id: powershell
          file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - name: Microsoft-Windows-PowerShell/Operational
    event_id: 4103, 4104, 4105, 4106
    processors:
      - script:
          lang: javascript
          id: powershell
          file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

  - name: ForwardedEvents
    tags: [forwarded]
    processors:
      - script:
          when.equals.winlog.channel: Security
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js
      - script:
          when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
      - script:
          when.equals.winlog.channel: Windows PowerShell
          lang: javascript
          id: powershell
          file: ${path.home}/module/powershell/config/winlogbeat-powershell.js
      - script:
          when.equals.winlog.channel: Microsoft-Windows-PowerShell/Operational
          lang: javascript
          id: powershell
          file: ${path.home}/module/powershell/config/winlogbeat-powershell.js

# ====================== Elasticsearch template settings =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false

# ================================== General ===================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging

# ================================= Dashboards =================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "https://192.168.216.129:5601"
   
  setup.kibana.ssl.enabled: true
  setup.kibana.ssl.certificate_authorities: ["C:\\Program Files\\Winlogbeat\\ca.crt"]
  setup.kibana.ssl.certificate: "C:\\Program Files\\Winlogbeat\\winlogbeat.crt"
  setup.kibana.ssl.key: "C:\\Program Files\\Winlogbeat\\winlogbeat.key"
  
  # verification_mode: none
  
  username: "elastic"
  password: "XXXXXXXXXXXXXXXXX"

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://192.168.216.129:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "https"
  output.elasticsearch.ssl.certificate_authorities: ["C:\\Program Files\\Winlogbeat\\ca.crt"]
  output.elasticsearch.ssl.certificate: "C:\\Program Files\\Winlogbeat\\winlogbeat.crt"
  output.elasticsearch.ssl.key: "C:\\Program Files\\Winlogbeat\\winlogbeat.key"
  # output.elasticsearch.sslverification_mode: none
  
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "XXXXXXXXXXXXXXX"

```

---

<div class="post-metadata">

**Author:** ![Julien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien/32/19688_2.png) [@Julien](https://discuss.elastic.co/u/Julien)\
**Post date:** [February 23, 2021, 10:51pm UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013/2 "2021-02-23T22:51:38Z")

</div>

You have specified `output.elasticsearch.output.elasticsearch.ssl.certificate_authorities` in winlogbeat.yml, the expected setting is `output.elasticsearch.ssl.certificate_authorities` (the other 2 invalid settings `output.elasticsearch.output.elasticsearch.ssl.certificate` and `output.elasticsearch.output.elasticsearch.ssl.key` are not needed so you can just remove them)

Please correct the yaml syntax as the self-signed certificate will require to provide the certificate\_authority certificate per the error `certificate signed by unknown authority`

You can also try to connect with curl first to verify the ca certificate is correct for certificate for `192.168.216.129`, the command should be something like this (I am not very familiar with Windows syntax for curl):  
`curl -cacert "C:\Program Files\Winlogbeat\ca.crt" https://192.168.216.129:9200`

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2021, 12:51am UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-dockrized-cluster-using-ssl/265013/3 "2021-03-24T00:51:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.