Logstash: Elasticsearch input plugin doesn't work

[Igor_Olikh (Igor)]

It sounds strange (at least for me) that the output plugin works:
elasticsearch
{
hosts => ["https://elastict:9200"]
user => "elastic"
password => "PASSWORD"
ssl => true
ssl_certificate_verification => true
cacert => "/etc/logstash/conf.d/certs/sub_ca.crt"
index => "indexname-%{+YYYY.MM.dd}"
}

but when I try to use input plugin:
elasticsearch {
hosts => "https://elastict:9200"
user => "elastic"
password => "PASSWORD"
ssl => true
ca_file => "/etc/logstash/conf.d/certs/sub_ca.crt"
index => "indexname"
}

I get the error: Failed to open TCP connection to https:0 (initialize: name or service not known)

[aaron-nimocks]

Compare the input and output. They require different data and different formats.

Try hosts => ["elastict:9200"] in your input.

[Igor_Olikh (Igor)]

Thank you Aaron. It changed the exception. Now I get "Certificate verify failed". I use the same certificate like in the output plugin. Should they be different?

[Badger]

The output accepts a .cer or .pem cert, the input requires a pem encoded cert.