# Logstash not starting after enabling xpac security

**URL:** <https://discuss.elastic.co/t/logstash-not-starting-after-enabling-xpac-security/252183>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [October 15, 2020, 11:18am UTC](https://discuss.elastic.co/t/logstash-not-starting-after-enabling-xpac-security/252183 "2020-10-15T11:18:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [October 15, 2020, 11:18am UTC](https://discuss.elastic.co/t/logstash-not-starting-after-enabling-xpac-security/252183/1 "2020-10-15T11:18:20Z")

</div>

Hello Team,

We are using ELK with 3 node cluster. Earlier we were using elasticsearch6.4 but now we upgraded to version6.8, because we want to use role base access feature.

We upgraded successfully our Elasticsaerch node, kibana node and logstash node.

We enable the `xpac security` by adding the below line in `elasticsaerch.yml` file over 3 elasticsearch nodes

```auto
xpack.security.enabled: true

```

We created the cert using below command over master node:

```auto
bin/elasticsearch-certutil cert

```

And we define the below line in our elasticsaerch.yml file:

```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificate.p12
xpack.security.transport.ssl.truststore.path: elastic-certificate.p12

```

Now we copied the same cert file i.e `elastic-certificate.p12` and define same config in `elasticsaerch.yml` file.

Over kibana we define the the below line in `kibana.yml`

```auto
elasticsearch.username: "kibana"
elasticsearch.password: "password"

```

The above username and passowrd we got when we run the below command on elasticsaerch master node:

```auto
bin/elasticsearch-setup-passwords auto

```

And start the kibana service. Now we can see the user, role tab inside Management-\>Security tab and we are able to create roles and users.

But now when we are starting logstash we are getting error:

We defined the below config in logstash output filter:

```auto
output {
  elasticsearch {
    hosts => ["192.168.57.4:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ssl => "true"
    cacert => "/etc/ssl/certs/elastic-certificate.p12"
    user => "elastic"
    password => "QjzmdpVIw47TrwTvOuo1"
  }
}

```

The user, passowrd and cert are we using for logstash are same whcih we got from the below commands:

```auto
bin/elasticsearch-certutil cert
bin/elasticsearch-setup-passwords auto

```

The error we are getting in logstash logs:

```auto
[ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Ch
eck the logs for more information.

Error registering plugin {:pipeline_id=>"main", :plugin=>"#<LogStash::OutputDelegator:0x14550
909>", :error=>"signed fields invalid"

```

We tried to search the solution for both the error but didn't get anything.

Can you please help us?

Thank You

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [October 15, 2020, 12:43pm UTC](https://discuss.elastic.co/t/logstash-not-starting-after-enabling-xpac-security/252183/2 "2020-10-15T12:43:30Z")

</div>

Hello Team,

Now this issue is resolved. Earlier i enabled SSL in logstash output filter. But after disabling the SSL and cacert flag fromlogstash is working fine.

New output plugin in logstash:

```auto
output {
  elasticsearch {
    hosts => ["192.168.57.4:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "QjzmdpVIw47TrwTvOuo1"
  }
}

```

Thank You

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2020, 12:43pm UTC](https://discuss.elastic.co/t/logstash-not-starting-after-enabling-xpac-security/252183/3 "2020-11-12T12:43:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.