# Logstash 7.8 beats input with SSL throws error

**URL:** <https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273>\
**Category:** Logstash\
**Created:** [July 30, 2020, 7:28pm UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273 "2020-07-30T19:28:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [July 30, 2020, 7:28pm UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273/1 "2020-07-30T19:28:59Z")

</div>

I added the SSL to the beats input and now the pipline throws an error. Cert and key are verified. See below 1) Config, 2) Cert and Key verify and 3) error in pipeline log.

```auto
input {
  beats {
    port => 5046
    ssl => true
    ssl_certificate_authorities => ["/etc/logstash/ca.crt"]
    ssl_certificate => "/etc/logstash/siem-logstash-01.crt"
    ssl_key => "/etc/logstash/siem-logstash-01.key"
    ssl_verify_mode => "force_peer"
  }
}

curl -XGET -u elastic: ******** --cacert /etc/logstash/ca.crt --cert /etc/logstash/siem-logstash-01.crt --key /etc/logstash/siem-logstash-01.key 'https://siem-elasticsearch-01:9200/_cluster/health?pretty'
{
  "cluster_name" : "siem-poc",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 62,
  "active_shards" : 62,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Error in logstash log:
[2020-07-30T19:04:50,184][ERROR][logstash.agent] Failed to execute action {:id=>:beats, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<beats>, action_result: false", :backtrace=>nil}

```

---

<div class="post-metadata">

**Author:** ![arun.vtec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun.vtec/32/45836_2.png) [@arun.vtec](https://discuss.elastic.co/u/arun.vtec)\
**Post date:** [August 6, 2020, 9:38am UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273/2 "2020-08-06T09:38:09Z")

</div>

Hello,

I am facing the same issue.  
My config file has one additional parameter - ssl\_key\_passphrase - under beats { }

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [August 6, 2020, 9:51am UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273/3 "2020-08-06T09:51:39Z")

</div>

Hello @frankfoti

We had similar issue and sollution we found here:  
[https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html)

ie:  
" SSL key to use. NOTE: This key need to be in the PKCS8 format, you can convert it with [OpenSSL](https://www.openssl.org/docs/man1.1.0/apps/pkcs8.html) for more information."

I converted pem key to pkcs8 in this way:

```auto
cd /etc/logstash/certs/
openssl pkcs8 -in node1.key -topk8 -nocrypt -out node1.p8
chown root.logstash node.p8

```

and change configuration file to:

```auto
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
    ssl_certificate => "/etc/logstash/certs/node1.crt"
    ssl_key => "/etc/logstash/certs/node1.p8"
    ssl_verify_mode => "force_peer"
  }
}

```

Please try this.

---

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [August 6, 2020, 11:55am UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273/4 "2020-08-06T11:55:59Z")

</div>

That did the trick. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2020, 11:56am UTC](https://discuss.elastic.co/t/logstash-7-8-beats-input-with-ssl-throws-error/243273/5 "2020-09-03T11:56:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.