# Logstash Shield integration

**URL:** <https://discuss.elastic.co/t/logstash-shield-integration/59800>\
**Category:** Logstash\
**Created:** [September 5, 2016, 10:17am UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800 "2016-09-05T10:17:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [September 5, 2016, 10:17am UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/1 "2016-09-05T10:17:28Z")

</div>

Hi ,

I have installed Shield on my Elasticsearch server, but unable to receive the events from logstash.

Do i need to install shield plugin on logstash instance?

And how the logstash output configuration looks like?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 5, 2016, 10:38am UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/2 "2016-09-05T10:38:41Z")

</div>

Have you had a look at [this](https://www.elastic.co/guide/en/shield/current/logstash.html)?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [September 5, 2016, 12:20pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/3 "2016-09-05T12:20:38Z")

</div>

Thanks Christian,

I have looked into the document, Do i require CA certificate ES cluster or AD server?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 5, 2016, 12:34pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/4 "2016-09-05T12:34:22Z")

</div>

Authentication against AD is optional, but you will need certificates if you want to use SSL. Are you able to connect to the cluster through other means, e.g. curl? Which versions are you using? Do you see any error messages from Logstash?

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [September 5, 2016, 12:39pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/5 "2016-09-05T12:39:21Z")

</div>

I am using logstash and ES -2.3.3 ,

I have configured logstash output as below:  
`elasticsearch { hosts => ["10.248.1.50:9200"] index => "qlikdemo-%{+YYYY.MM.dd}" template_overwrite => true user => logstashuser password => password}`

Getting errors like below:

```
Sep 05, 2016 8:34:06 AM org.apache.http.impl.execchain.RetryExec execute
INFO: I/O exception (org.apache.http.NoHttpResponseException) caught when processing request to {}->http://10.248.1.50:9200: The target server failed to respond

```

`Attempted to send a bulk request to Elasticsearch configured at '["http://10.248.1.50:9200/"]', but an error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided? {:error_message=>"10.248.1.50:9200 failed to respond"`

Kindly help me.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 5, 2016, 12:44pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/6 "2016-09-05T12:44:15Z")

</div>

If you have SSL enabled, I believe you need to specify the [ssl parameter for the output filter](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ssl).

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [September 5, 2016, 12:48pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/7 "2016-09-05T12:48:25Z")

</div>

Do i need to generate CA certificate from ES cluster or AD?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 5, 2016, 3:12pm UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/8 "2016-09-05T15:12:21Z")

</div>

Have you tried with the ssl parameter enabled? Are you able to connect using curl? How did you setup Shield on your cluster?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/logstash-shield-integration/59800/9 "2017-07-06T04:39:51Z")

</div>