# How to Setup FileBeat with Basic Auth for LogStash Output?

**URL:** <https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 11, 2015, 4:49am UTC](https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937 "2015-12-11T04:49:12Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 30, 2016, 12:01pm UTC](https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937/17 "2016-03-30T12:01:21Z")

</div>

I didn't test this yet (there might be some subtle errors in examples). You will at least need most recent logstash-input-beats plugin (hopefully including the PR already) to configure client auth.

For client-auth you need to have some certificate authority (CA) to verify the clients certificate + enable authentication server side (as Server must request client for its certificate).

Set list of CAs in `ssl_certificate_authorities` and enable server verification by setting `ssl_verify_mode` to `"force_peer"` (most strict option).  
List of CAs must either include the self-signed certificate used by the client or better the root certificate used to sign the client certificate. Advantage of root certificate is, you have to configure logstash only once and can create/revoke client certificate any time (add more clients to network without updating logstash config).

On client side we need the actual certificate + key. In filebeat configure `certificate` and `certificate_key`.

For testing the config you can start with having logstash and filebeat running on same host (with same domain) and use same certificate for logstash and filebeat. But in production you will need separate certificates for both, logstash and filebeat.

Following [this tutorial](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) (assuming your are using the domain names + self-signed certificates without root CAs) check out the "Generate SSL Certificates" section and adapt:

```auto
$ sudo mkdir -p /etc/pki/tls/certs
$ sudo mkdir /etc/pki/tls/private
$ cd /etc/pki/tls

```

```auto
$ sudo openssl req -subj '/CN=<logstash-server-domain>/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash.key -out certs/logstash.crt
$ sudo openssl req -subj '/CN=<filebeat-client-domain>/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/filebeat.key -out certs/filebeat.crt

```

The `02-beats-input.conf` must say:

```auto
input {
  beats {
    port => 5044
    ssl => true # enable TLS/SSL

    # configure logstash server certificate being presented to filebeat
    ssl_certificate => "/etc/pki/tls/certs/logstash.crt"
    ssl_key => "/etc/pki/tls/private/logstash.key"

    # configure client auth + filebeat cert for validation
    ssl_verify_mode => "force_peer",
    ssl_certificate_authorities => ["/etc/pki/tls/certs/filebeat.crt"],
  }
}

```

In filebeat.yml enable TLS + add certificate:

```auto
logstash:
  tls:
      # List of root certificates for server verifications
      certificate_authorities: ["/etc/pki/tls/certs/logstash.crt"]

      # client certificate + key for client auth (if requested by server)
      certificate: "/etc/pki/tls/certs/filebeat.crt"
      certificate_key: "/etc/pki/tls/private/filebeat.key"

```

NOTE: when copying certificates + key files only copy files required. Logstash does not require filebeat.key and filebeat does not require logstash.key.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-setup-filebeat-with-basic-auth-for-logstash-output/36937)._