# Logstash error, Unable to connect with elasticsearch after enabling ssl

**URL:** https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [September 1, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066 "2020-09-01T09:29:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Vi\_shal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vi_shal/32/74792_2.png) [@Vi\_shal](https://discuss.elastic.co/u/Vi_shal)
#### Post date: [September 1, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066/1 "2020-09-01T09:29:27Z")

</div>

I have an elk setup (1 master ES, 3 worker es, 1 logstash, 1 kibana) with filebeat being the log collector/emitter. Post enabling x-pack and TLS, ES and Kibana is working fine. the problem is with logstash. I'm currently seeing this error in `/var/log/logstash/logstash-plain.log.`

> [ERROR][logstash.javapipeline][filebeat] Pipeline aborted due to error {:pipeline\_id=\>"filebeat", :exception=\>#\<Manticore::UnknownException: Unrecognized SSL message, plaintext connection?\>, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'"

I can also see below logs in the elasticsearch master server:

> [2020-09-01T07:13:20,323][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [esmasternode1] received plaintext traffic on an encrypted channel, closing connection Netty4TcpChannel{localAddress=/10.1.1.6:9300, remoteAddress=/publicipaddress:35166} [2020-09-01T07:13:20,865][WARN][o.e.t.TcpTransport] [esmasternode1] exception caught on transport layer [Netty4TcpChannel{localAddress=/10.1.1.6:9300, remoteAddress=/publicipaddress:35326}], closing connection

Below are my logstash and filebeat configurations. I have setup logstash as output in filebeat and filebeat as in input in my logstash config.

**Logstash.conf**

```auto
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/logstash/logstashcert.crt"
    ssl_key => "/etc/logstash/logstashcert.key"
  }
}

filter { json { source => "message" remove_field => ["message"] } }

output {
  elasticsearch {
  hosts => ["https://esmasterprivateIP:9200"]
    index => "logs-%{+YYYY-MM-dd}"
    manage_template => true
    template => "/etc/logstash/conf.d/template.json"
    template_name => "mytemplate"
    ssl => true
    cacert => '/home/ubuntu/esca.pem'
    user => logstash_user
    password => mypassword

  }
}

```

**Filebeat.conf**

```auto
    output.logstash:
      workers: 2
      enabled: true
      protocol: "https"
      hosts: ['logstashprivateip:5044']
      path: "/"
      ssl:
      certificate_authorities: [“/etc/tls.crt”]

```

I'm unable to trace down where I'm going wrong.

**Note:** Filebeat is running in kubernetes, Hence the config might look slightly different as it is passed through configmap.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-unable-to-connect-with-elasticsearch-after-enabling-ssl/247066/2 "2020-09-29T09:29:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.