# Logshtash 5.5.1 Kafka output SASL\_SSL Error

**URL:** https://discuss.elastic.co/t/logshtash-5-5-1-kafka-output-sasl-ssl-error/95518
**Category:** Logstash
**Created:** [August 2, 2017, 12:26pm UTC](https://discuss.elastic.co/t/logshtash-5-5-1-kafka-output-sasl-ssl-error/95518 "2017-08-02T12:26:25Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![luis.carvalho](https://avatars.discourse-cdn.com/v4/letter/l/d07c76/32.png) [@luis.carvalho](https://discuss.elastic.co/u/luis.carvalho)
#### Post date: [August 2, 2017, 12:26pm UTC](https://discuss.elastic.co/t/logshtash-5-5-1-kafka-output-sasl-ssl-error/95518/1 "2017-08-02T12:26:25Z")

</div>

Hi,

I want to produce logs to a Kafka cluster with SASL/Kerberos security. The Kafka cluster is working and tested with KafkaConsoleProducer, but with my Logstash configs it returns the error:

> [ERROR][logstash.outputs.kafka] Unable to create Kafka producer from given configuration {:kafka\_error\_message=\>org.apache.kafka.common.KafkaException: Failed to construct kafka producer}

> [ERROR][logstash.agent] Pipeline aborted due to error {:exception=\>org.apache.kafka.common.KafkaException: Failed to construct kafka producer, :backtrace=\>["org.apache.kafka.clients.producer.KafkaProducer.(org/apache/kafka/clients/producer/KafkaProducer.java:335)", "org.apache.kafka.clients.producer.KafkaProducer.(org/apache/kafka/clients/producer/KafkaProducer.java:188)", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:423)", "RUBY.create\_producer(/usr/local/src/ELK/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/logstash-output-kafka-5.1.7/lib/logstash/outputs/kafka.rb:242)", "RUBY.register(/usr/local/src/ELK/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/logstash-output-kafka-5.1.7/lib/logstash/outputs/kafka.rb:178)", "RUBY.register(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/output\_delegator\_strategies/shared.rb:9)", "RUBY.register(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/output\_delegator.rb:41)", "RUBY.register\_plugin(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:281)", "RUBY.register\_plugins(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:292)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)", "RUBY.register\_plugins(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:292)", "RUBY.start\_workers(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:301)", "RUBY.run(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:226)", "RUBY.start\_pipeline(/usr/local/src/ELK/logstash-5.5.1/logstash-core/lib/logstash/agent.rb:398)", "java.lang.Thread.run(java/lang/Thread.java:748)"]}

**Logstash version:** 5.5.1  
**Plugin version:** 5.1.7  
**Kafka version:** 0.10.2.0  
**Java version:** 1.8.0\_131  
**Ruby version:** 2.0.0p648 (2015-12-16) [x86\_64-linux]  
**OS:** RedHat 7

**Logstash output config:**

```
kafka {
  topic_id => "acled-test-topic"
  bootstrap_servers => "<kafka1_host>:9092,<kafka2_host>:9092"
  security_protocol => "SASL_SSL"
  ssl_truststore_location => "<path_to>/kafka.client.truststore.jks"
  ssl_truststore_password => "MYPASS"
  ssl_keystore_location => "<path_to>/kafka.client.keystore.jks"
  ssl_keystore_password => "MYPASS"
  ssl_key_password => "MYPASS"
  kerberos_config => "/etc/krb5.conf"
  sasl_kerberos_service_name => "kafka"
  jaas_path => "<path_to>/kafka_client_jaas.conf"
  sasl_mechanism => "GSSAPI"
  client_id => "kafka"
}

```

**kafka\_client\_jaas.conf:**

> KafkaClient {  
> com.sun.security.auth.module.Krb5LoginModule required  
> doNotPrompt=true  
> useTicketCache=true  
> renewTicket=true  
> serviceName="kafka"  
> client=true;  
> };

**krb5.conf:**

> #Configuration snippets may be placed in this directory as well  
> includedir /etc/krb5.conf.d/  
> [logging]  
> default = FILE:/var/log/krb5libs.log  
> kdc = FILE:/var/log/krb5kdc.log  
> admin\_server = FILE:/var/log/kadmind.log  
> [libdefaults]  
> dns\_lookup\_realm = false  
> dns\_lookup\_kdc = false  
> ticket\_lifetime = 24h  
> renew\_lifetime = 7d  
> forwardable = true  
> default\_realm = DOMAIN\_NAME  
> [realms]  
> DOMAIN\_NAME = {  
> kdc = KAFKA1\_HOST  
> admin\_server = KAFKA1\_HOST  
> }

**Kafka Broker security server.properties:**

> ######## Server Basics #######  
> #The id of the broker. This must be set to a unique integer for each broker.  
> broker.id=21
> 
> listeners=SASL\_SSL://:9092  
> advertised.listeners=SASL\_SSL://:9092  
> port=9092  
> log.dirs=\<kafka-log\_path\>
> 
> ssl.key.password=MYPASS  
> ssl.keystore.location=\<path\_to\>/kafka.server.keystore.jks  
> ssl.keystore.password=MYPASS  
> ssl.truststore.location=\<path\_to\>/kafka.server.truststore.jks  
> ssl.truststore.password=MYPASS  
> ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
> 
> allow.everyone.if.no.acl.found=true  
> principal.to.local.class=kafka.security.auth.KerberosPrincipalToLocal
> 
> super.users=User:kafka  
> kafka\_principal\_name=kafka/KAFKA1\_HOST@DOMAIN\_NAME  
> kafka\_keytab=\<path\_to\>/kafka.service.keytab
> 
> authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer  
> sasl.enabled.mechanisms=GSSAPI  
> sasl.mechanism.inter.broker.protocol=GSSAPI  
> security.inter.broker.protocol=SASL\_SSL
> 
> zookeeper.connect=KAFKA1\_HOST:2181,KAFKA2\_HOST:2181  
> zookeeper.connection.timeout.ms=25000  
> zookeeper.session.timeout.ms=30000  
> zookeeper.sync.time.ms=2000

Someone has already encountered this issue? Am i missing some configuration?  
Can anyone help me to resolve this issue?

Thanks,  
LC

---

<div class="post-metadata">

### Author: ![vijayanand](https://avatars.discourse-cdn.com/v4/letter/v/3ab097/32.png) [@vijayanand](https://discuss.elastic.co/u/vijayanand)
#### Post date: [August 7, 2017, 11:29pm UTC](https://discuss.elastic.co/t/logshtash-5-5-1-kafka-output-sasl-ssl-error/95518/2 "2017-08-07T23:29:01Z")

</div>

I am also having the same error. please let me know if you got any workaround.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2017, 11:29pm UTC](https://discuss.elastic.co/t/logshtash-5-5-1-kafka-output-sasl-ssl-error/95518/3 "2017-09-04T23:29:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.