# Logstash output to Elasticsearch SSL 6.3 issue

**URL:** <https://discuss.elastic.co/t/logstash-output-to-elasticsearch-ssl-6-3-issue/159426>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [December 4, 2018, 10:27pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-ssl-6-3-issue/159426 "2018-12-04T22:27:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [December 4, 2018, 10:27pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-ssl-6-3-issue/159426/1 "2018-12-04T22:27:00Z")

</div>

I generated the cert and keays using "bin/elasticsearch-certutil" with " CERT mode" and let it generate the CA as well.

A 2 node cluster and kibana are tsl and http.ssl enabled fine.

Logstash output to elasticsearch with thowing an error: "[FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Setting "xpack.ssl.key" hasn't been registered\>"

I have tried a number of variations and stuck on this now.

logstash output config:  
output {  
elasticsearch {  
hosts =\> ["https://\*\*\*\*\*\*\*:9200"]  
index =\> "metricbeat-config-%{+YYYY.MM.dd}"  
ssl =\> true  
cacert =\> '/etc/logstash/mmetricbeats/ca.crt'  
sniffing =\> true  
user =\> \*\*\*\*\*  
password =\> \*\*\*\*\*\*  
}  
}

logstash yml configured as:  
xpack.ssl.key: /etc/logstash/metricbeats/metricbeat.key  
xpack.ssl.certificate: /etc/logstash/metricbeats/metricbeat.crt  
xpack.ssl.certificate\_authorities: ["/etc/logstash/metricbeats/ca.crt"]  
xpack.security.http.ssl.enabled: true

---

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [December 5, 2018, 9:47pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-ssl-6-3-issue/159426/2 "2018-12-05T21:47:53Z")

</div>

Fixed this, turned sniffing to false, removed logstash.yml entries and generated a new ca cert

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2019, 9:47pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-ssl-6-3-issue/159426/3 "2019-01-02T21:47:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.