# Logstash SSL configuration problem

**URL:** <https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404>\
**Category:** Logstash\
**Created:** [May 6, 2016, 12:09pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404 "2016-05-06T12:09:58Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 6, 2016, 12:09pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/1 "2016-05-06T12:09:58Z")

</div>

Okei so i have this case:  
I have tree server which are running the whole stack, and they are set up so:  
Filebeat =\> Logstash =\> Elasticsearch/Kibana

And I successfully configured that the Filebeat sends logs from his server all too the Elasticksearch/Kibana without any security. But now I would like to use SSL to secure the connection between those servers. What I did so far I could create a self signed certificate on the Logstash server and copied the Filebeat server so that he can verify that thats the correct server so Filebeat =\> Logstash works. What I could not get to working is Logstash =\> Elasticsearch/kibana It writes an error in the logs really late, like it waits filebeat to first send the logs and than it gets and error.

So my question is, how do I correctly configure that Logstash so it can communicate with the Elasticsearch/kibana sever with SSL correctly?

So here is my config from Logstash:

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

output {  
elasticsearch {  
hosts =\> "123.123.123:9200" #please ignore the random IP  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
ssl =\> true  
ssl\_certificate\_verification =\> true  
}  
}

Here is part of the errorlog:

{:timestamp=\>"2016-05-06T12:06:20.808000+0000", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '["[https://12.12.12.12:9200/](https://12.12.12.12:9200/)"]', but an error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided?", :client\_config=\>{:hosts=\>["[https://12.12.12.12:9200/](https://12.12.12.12:9200/)"], :ssl=\>{}, :transport\_options=\>{:socket\_timeout=\>0, :request\_timeout=\>0, :proxy=\>nil, :ssl=\>{}}, :transport\_class=\>Elasticsearch::Transport::Transport::HTTP::Manticore, :logger=\>nil, :tracer=\>nil, :reload\_connections=\>false, :retry\_on\_failure=\>false, :reload\_on\_failure=\>false, :randomize\_hosts=\>false}, :error\_message=\>"SSL peer shut down incorrectly", :error\_class=\>"Manticore::ClientProtocolException", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:35:in `initialize'", "org/jruby/RubyProc.java:271:in`call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:70:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:245:in`call\_once'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:148:in `code'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:71:in`perform\_request'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/base.rb:191:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/client.rb:119:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.14/lib/elasticsearch/api/actions/bulk.rb:87:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:56:in`bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:353:in `submit'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:350:in `submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:382:in`flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/buffer.rb:219:in `buffer_flush'", "org/jruby/RubyHash.java:1342:in`each'", java/lib/logstash/outputs/elasticsearch.rb:343:in `receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/outputs/base.rb:80:in`handle'", "(eval):22:in `output_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:252:in`outputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:169:in `start\_outputs'"], :level=\>:error}

---

<div class="post-metadata">

**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\
**Post date:** [May 6, 2016, 1:12pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/2 "2016-05-06T13:12:54Z")

</div>

Is elasticsearch running shield or running behind a ssl proxy? If not elasticsearch isn't using ssl so your logstash config to output to es will error.

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 6, 2016, 1:24pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/3 "2016-05-06T13:24:54Z")

</div>

my Elasticsearch/kibana is runing nginx with SSL yes.

---

<div class="post-metadata">

**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\
**Post date:** [May 6, 2016, 1:28pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/4 "2016-05-06T13:28:54Z")

</div>

then your output host should point to the proxy address and not es on 9200, it should be `https://<proxy>/<proxy location>` . You may also need certificate to be configure in the elasticsearch output section.

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 6, 2016, 2:50pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/5 "2016-05-06T14:50:26Z")

</div>

So you mean like:

output {  
elasticsearch {  
hosts =\> "https:domain.com:443"

?

---

<div class="post-metadata">

**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\
**Post date:** [May 6, 2016, 3:12pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/6 "2016-05-06T15:12:14Z")

</div>

If you are are proxying elasticsearch:9200 at / then yes you can configure it that way.

and hosts would be hosts =\> "[https://esserver:443](https://esserver:443)" or just "[https://esserver](https://esserver)"

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 9, 2016, 9:13am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/7 "2016-05-09T09:13:31Z")

</div>

So I tried to do it like you said, just writing the domainname too hosts but than I got an Ruby error, so than I tried to enter the certificates from my Elasticsearch/Kibana server and after that I got another shorter error.

timestamp=\>"2016-05-09T09:12:20.383000+0000", :message=\>"The error reported is: \n undefined method `toCharArray' for nil:NilClass"

This is my config now:  
input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

output {  
elasticsearch {  
hosts =\> "[https://domain.com](https://domain.com)"  
ssl =\> true  
keystore =\> /etc/logstash/ssl/somecerts.key  
truststore =\> /etc/logstash/ssl/somecerts.crt  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 9, 2016, 11:58am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/8 "2016-05-09T11:58:31Z")

</div>

Okei, I found another documentation and tried it this way:

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

output {  
elasticsearch {  
hosts =\> "[https://domain.com](https://domain.com)"  
ssl =\> true  
cacert =\> '/etc/logstash/ssl/cert.pem'  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

but than I got this error:  
timestamp=\>"2016-05-09T11:58:06.268000+0000", :message=\>"Failed to flush outgoing items", :outgoing\_count=\>1, :exception=\>"Manticore::ClientProtocolException", :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:35:in `initialize'", "org/jruby/RubyProc.java:271:in`call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:70:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:245:in`call\_once'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/manticore-0.4.4-java/lib/manticore/response.rb:148:in `code'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:71:in`perform\_request'", "org/jruby/RubyProc.java:271:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/base.rb:191:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/transport/http/manticore.rb:54:in `perform_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-transport-1.0.14/lib/elasticsearch/transport/client.rb:119:in`perform\_request'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/elasticsearch-api-1.0.14/lib/elasticsearch/api/actions/bulk.rb:87:in `bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:56:in`bulk'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:353:in `submit'", "org/jruby/ext/thread/Mutex.java:149:in`synchronize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:350:in `submit'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:382:in`flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/buffer.rb:219:in `buffer_flush'", "org/jruby/RubyHash.java:1342:in`each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/buffer.rb:216:in `buffer_flush'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/buffer.rb:159:in`buffer\_receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.1.2-java/lib/logstash/outputs/elasticsearch.rb:343:in `receive'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/outputs/base.rb:80:in`handle'", "(eval):22:in `output_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:252:in`outputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:169:in `start\_outputs'"], :level=\>:warn

---

<div class="post-metadata">

**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\
**Post date:** [May 9, 2016, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/9 "2016-05-09T13:52:53Z")

</div>

> [@Aljaz\_Gantar](#):
>
> :message=\>"Failed to flush outgoing items",

Are there any errors that you see in the elasticsearch logs. Logstash isn't able to send all the data to elasticsearch.

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [May 10, 2016, 7:41am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/10 "2016-05-10T07:41:16Z")

</div>

This is something to do with the SSL connection, I dont know what?

Could you please give me a example how do I do the SSL connection to my domain with certificates.  
Lets just say my domain is [https://domain.com](https://domain.com) and have the certificates from nginx in /etc/pki/ssl/cert.crt/cert.key

How should I configure than my output { ??

---

<div class="post-metadata">

**Author:** ![Bhavana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavana/32/12221_2.png) [@Bhavana](https://discuss.elastic.co/u/Bhavana)\
**Post date:** [February 1, 2017, 5:14pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/11 "2017-02-01T17:14:49Z")

</div>

Hello ,

I am facing the similar issue now,

ES version - 2.3.5 , Logstash - 2.4

'Attempted to send bulk request to Elasticsearch, configured at ["[xxxx.com:9200](http://xxxx.com:9200)"] , An error occurred and it failed! Are you sure you can reach elasticsearch from this machine using the configuration provided ? "SSL peer shut down incorrectly", Manticore::ClientProtocolException logstash"'

My logstash Output section:

output  
{  
stdout { codec =\> rubydebug }  
stdout { codec =\> json }  
elasticsearch  
{  
user =\> "xxxx"  
password =\> "xxx"  
index =\> "wrike\_jan"  
document\_type =\> "data"  
hosts =\> ["[xxxx.com:9200](http://xxxx.com:9200)"]  
ssl =\> true  
ssl\_certificate\_verification =\> false  
truststore =\> "elasticsearch-2.3.5/config/truststore.jks"  
truststore\_password =\> "83dfcdddxxxxx"  
}  
}  
Logstash file is executed , but it is failing to send the data to ES.

could you please suggest , thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404/12 "2017-07-06T04:28:58Z")

</div>