# Kafka Connect sink - ElasticSearch interface via SSL **URL:** \ **Category:** Elasticsearch\ **Created:** [February 18, 2019, 1:49pm UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839 "2019-02-18T13:49:19Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![mihai2018](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@mihai2018](https://discuss.elastic.co/u/mihai2018)\ **Post date:** [February 18, 2019, 1:49pm UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/1 "2019-02-18T13:49:19Z")
Hi guys. One of our UCs asks for outputting data out of Kafka Connector sink to Elastic Search (Logstash is bypassed). Now Elastic 6.6 needs SSL to be enabled (which is ok as it should be there for other security considerations). However this does not work, Kafka Connect does not seem to speak SSL at the moment. Moreover, here is a quote from their site: **[https://docs.confluent.io/3.1.2/connect/connect-elasticsearch/docs/elasticsearch\_connector.html#security](https://docs.confluent.io/3.1.2/connect/connect-elasticsearch/docs/elasticsearch_connector.html#security)** ## Security The Elasticsearch connector can read data from secure Kafka by following the instructions in the [Connect security documentation](https://docs.confluent.io/3.1.2/connect/security.html#connect-security). The functionality to write data to a secured Elasticsearch instance is not yet implemented. Is this known to the ES team ? While not exactly your problem it impacts an important interface of your product, maybe you know more on it. Any hint appreciated. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 22, 2019, 9:08am UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/2 "2019-02-22T09:08:17Z")
Hi there, thanks for you message. Since this is a 3rd party plugin, would you mind opening an issue or an enhancement request with Confluent? ---
**Author:** ![mihai2018](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@mihai2018](https://discuss.elastic.co/u/mihai2018)\ **Post date:** [February 22, 2019, 3:17pm UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/3 "2019-02-22T15:17:07Z")
thanks so much for your totally useless and unprofessional response. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 22, 2019, 3:47pm UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/4 "2019-02-22T15:47:07Z")
I can totally understand your frustration here but what @ikakavas wrote is the truth. If a 3rd party software does not support a mandatory feature, then you need to ask this 3rd party to add it. > The functionality to write data to a secured Elasticsearch instance is not yet implemented. In the latest Kafka elasticsearch connector version (5.1.2), they seemed to have made some progress though. See [https://docs.confluent.io/current/connect/kafka-connect-elasticsearch/index.html#security](https://docs.confluent.io/current/connect/kafka-connect-elasticsearch/index.html#security) > The Elasticsearch connector can write data to a secure Elasticsearch cluster that supports basic authentication by setting the `connection.username` and `connection.password` configuration properties. Do you have a chance to test it? I'm not sure if it supports https though. But for sure the right answer is to be found in Kafka mailing list. I don't think there is a way to disable TLS once security is activated on an elasticsearch cluster running 6.6+... ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [February 22, 2019, 5:39pm UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/5 "2019-02-22T17:39:51Z")
> [@mihai2018](#): > > thanks so much for your totally useless and unprofessional response. This is not a good way to respond to someone that was only trying to help you, especially on a community forum for an open source project, but frankly ever. Posting confrontationally like this establishes you as an adversary rather than a collaborator, is an ineffective way to make a point, and contributes to building a poor reputation for yourself. I say this hoping that it will have a positive impact on you but even if not I state it for the benefit of the entire community that we expect civil discourse here. ---
**Author:** ![mihai2018](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@mihai2018](https://discuss.elastic.co/u/mihai2018)\ **Post date:** [February 25, 2019, 7:47am UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/6 "2019-02-25T07:47:14Z")
Hi Jason. Sure, I do apologize for the tone. However that does not change the essence of the matter. You say , quote: "... to respond to someone that was only trying to help you ...". What kind of help are you meaning here ? The answer received simply repeated what myself have already indicated: that Connect does not support out-of-the-box SSL. I had obviously asked for a work-around, if any, based on the assumption that your team has got a lot of experience with that. Look at the answer of David above, who does make an effort to analyze the situation (really thx for that), admitting of course that the problem lies with Kafka. So perhaps a nice answer from yourself, apart from putting me to the wall (which is ok) would have also to add something really technically useful. Which you did not. How about, in the future, 1 sentence dealing with moral issues + 1 dealing with technical issues ? Anyway, thanks for your remarks, they do help me, perhaps mine will also help you and your team. ---
**Author:** ![mihai2018](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@mihai2018](https://discuss.elastic.co/u/mihai2018)\ **Post date:** [February 25, 2019, 7:57am UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/7 "2019-02-25T07:57:59Z")
Hi David, And really thanks for your balanced answer (again, I do admit my high tone was wrong, still I also do maintain a "commercial" answer is not really helpful in a forum). but to the point: indeed we do not want to disable TLS. If not for other reason then because we need it to activate SAML authentication for other applications. So basic authentication is not enough overall. And anyway, in the end we did find the solution: manually add the server's certificate into client java's "cacerts" keystore. Sure enough, not so convenient and reliable as a simple entry into a dedicated configuration file but for now it worked fine. Best regards. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 25, 2019, 8:32am UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/8 "2019-02-25T08:32:49Z")
> [@mihai2018](#): > > You say , quote: "... to respond to someone that was only trying to help you ...". What kind of help are you meaning here ? The answer received simply repeated what myself have already indicated: that Connect does not support out-of-the-box SSL. I had obviously asked for a work-around, if any, based on the assumption that your team has got a lot of experience with that. In that context, the "help" was the confirmation that your statement is true (Connect does not support out of the box SSL) and the suggestion that the quickest way to resolution for you, would probably be an enhancement request with the maintainers of the software component that was lacking the feature/functionality you need. It might have been short and apologies if the length of it made it sound dismissive, but we try to go through and help with as many topics as possible and sometimes, short answers are what we come up with 🙂 No matter how much longer I could have explained it though, the cause/analysis/suggestion would remain exactly the same. You can retain the right to think this is "totally useless" and "unprofessional" as I do retain the right to think otherwise and definitely know that this was neither the intent nor the goal of that message. I'm glad you have found a workaround for the issue and hope this helps others facing the same limitation. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 25, 2019, 8:32am UTC](https://discuss.elastic.co/t/kafka-connect-sink-elasticsearch-interface-via-ssl/168839/9 "2019-03-25T08:32:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.