# Logstash TCP output to logstash TCP input with SSL error **URL:** \ **Category:** Logstash\ **Created:** [May 8, 2019, 9:54am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146 "2019-05-08T09:54:50Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![thangld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thangld/32/82551_2.png) [@thangld](https://discuss.elastic.co/u/thangld)\ **Post date:** [May 8, 2019, 9:54am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/1 "2019-05-08T09:54:51Z")
Hi all. I'm trying to test Logstash TCP input plugin with SSL configuration so I run two logstash instance, one for TCP output and one for TCP input. These are my settings: **input.conf** : ```auto input { tcp { port => 9443 mode => "server" ssl_enable => true ssl_cert => "/home/sf/thangld13/244cert/server.crt" ssl_extra_chain_certs => "/home/sf/thangld13/244cert/ca.crt" ssl_key => "/home/sf/thangld13/244cert/server.key" ssl_verify => true } } filter { if (1 == 2) { } } output { stdout { codec => rubydebug } } ``` **output.conf** ```auto input { file { path => "/var/log/auth.log" start_position => "beginning" } } filter { if (1 == 2) { } } output { tcp { port => 9443 host => "localhost" ssl_enable => true ssl_cacert => "/home/sf/thangld13/244cert/ca.crt" ssl_key => "/home/sf/thangld13/244cert/client.key" ssl_cert => "/home/sf/thangld13/244cert/client.crt" ssl_verify => false } } ``` Then I run ```auto /usr/share/logstash/bin/logstash -f input.conf /usr/share/logstash/bin/logstash -f output.conf --path.data /home/sf/thangld13/logstash/data/ ``` And the first instance gives me this error: ```auto java.lang.OutOfMemoryError: Java heap space Dumping heap to java_pid21649.hprof ... Heap dump file created [1075541011 bytes in 6.984 secs] The signal INT is in use by the JVM and will not work correctly on this platform [ERROR] 2019-05-08 16:46:39.263 [pool-2-thread-10] deadletterqueue - PeriodicPoller: exception {:poller=>#, @listeners=>, @id_path="/usr/share/logstash/data/uuid", @metric=#...:polling_timeout=>120, :polling_interval=>5, :executed_at=>2019-05-08 16:46:39 +0700} Error: Your application used more memory than the safety cap of 1G. Specify -J-Xmx####m to increase it (#### = cap size in MB). Specify -w for full OutOfMemoryError stack trace ``` Then It shuts down. Can anyone tell me what is wrong here? Thanks! ---
**Author:** ![thangld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thangld/32/82551_2.png) [@thangld](https://discuss.elastic.co/u/thangld)\ **Post date:** [May 8, 2019, 10:04am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/2 "2019-05-08T10:04:40Z")
Update 1: After I set ssl\_verify to false for both input and output it gives me this error: ```auto java.lang.OutOfMemoryError: Java heap space Dumping heap to java_pid23084.hprof ... Heap dump file created [1075397956 bytes in 9.455 secs] Error: Your application used more memory than the safety cap of 1G. Specify -J-Xmx####m to increase it (#### = cap size in MB). Specify -w for full OutOfMemoryError stack trace ``` Update 2: After I set ssl\_verify to true for both input and output, it gives me the same error as Update 1. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 8, 2019, 12:54pm UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/3 "2019-05-08T12:54:19Z")
The first few lines of /etc/logstash/jvm.options control the initial and maximum heap size. At a minimum you need to increase the maximum heap size. ---
**Author:** ![thangld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thangld/32/82551_2.png) [@thangld](https://discuss.elastic.co/u/thangld)\ **Post date:** [May 9, 2019, 7:12am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/4 "2019-05-09T07:12:09Z")
It still gives out the same error after I increased the maximum heap size. When I try to add `ssl_certificate_authorities` to the input config, it gives me this error: `[LogStash::Runner] tcp - Unknown setting 'ssl_certificate_authorities' for tcp`. My logstash version is 5.6.16. How can I use CA for this version then? Thanks. ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [May 9, 2019, 7:31am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/5 "2019-05-09T07:31:50Z")
I have not connected Logstash to Logstash over TCP with SSL but maybe it is similar to how Filebeat works... I use this for Filebeat (would be similart to your output.conf). I use self-signed SSL certs ``` ssl: certificate_authorities: - "/etc/filebeat/ssl/star.example.com" ``` IIRC that is the intermediate cert ^^ The `beats` input is configured with this (would be similar to your input.conf) ``` ssl => true ssl_certificate => "/etc/logstash/ssl/example.com.crt" ssl_key => "/etc/logstash/ssl/example.com.key" ``` Hope that helps. ---
**Author:** ![thangld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thangld/32/82551_2.png) [@thangld](https://discuss.elastic.co/u/thangld)\ **Post date:** [May 9, 2019, 7:56am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/6 "2019-05-09T07:56:32Z")
I think It has successfully verified. It doesn't give any handshake errors. But it doesn't write each event log to the terminal. Instead, when I stop the sending logstash, the receiving logstash gives out all the events at once and as it is just one event... **Sending logstash** : ```auto input { file { path => "/var/log/auth.log" start_position => "beginning" } } filter { if (1 == 2) { } } output { tcp { port => 9443 host => "localhost" ssl_enable => true ssl_cacert => "/home/sf/thangld13/244cert/ca.crt" ssl_key => "/home/sf/thangld13/244cert/client.key" ssl_cert => "/home/sf/thangld13/244cert/client.crt" #ssl_verify => true } } ``` **Receiving logstash** : ```auto input { tcp { port => 9443 mode => "server" ssl_enable => true ssl_cert => "/home/sf/thangld13/244cert/server.crt" ssl_cacert => "/home/sf/thangld13/244cert/ca.crt" ssl_key => "/home/sf/thangld13/244cert/server.key" #ssl_verify => true } } filter { if (1 == 2) { } } output { stdout { codec => rubydebug } } ``` **Receiving logstash output** : ```auto { "@version" => "1", "host" => "127.0.0.1", "@timestamp" => 2019-05-09T08:26:47.268Z, "message" => "{ **A LOT OF EVENT**... ...{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.022Z\",\"message\":\"Sep 20 02:00:15 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.022Z\",\"message\":\"Sep 20 02:00:16 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.022Z\",\"message\":\"Sep 20 02:00:19 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.022Z\",\"message\":\"Sep 20 02:00:19 siem sshd[2167]: channel 6: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:23 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:23 siem sshd[2167]: channel 6: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:27 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:27 siem sshd[2167]: channel 6: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:30 siem sshd[2167]: channel 5: open failed: connect failed:\"}{\"@version\":\"1\",\"host\":\"siem\",\"path\":\"/var/log/auth.log\",\"@timestamp\":\"2019-05-09T07:39:08.023Z\",\"message\":\"Sep 20 02:00:32 siem sshd[2167]: channel 5: open failed: connect failed:\"}", "port" => 57976 } ``` ---
**Author:** ![thangld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thangld/32/82551_2.png) [@thangld](https://discuss.elastic.co/u/thangld)\ **Post date:** [May 9, 2019, 10:20am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/7 "2019-05-09T10:20:48Z")
Problem solved! I finally manage to solve my problem by adding this line to both TCP input and TCP output: `codec => "json_lines"` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2019, 10:20am UTC](https://discuss.elastic.co/t/logstash-tcp-output-to-logstash-tcp-input-with-ssl-error/180146/8 "2019-06-06T10:20:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.