# 【Logstash】The output configuration of logstash cannot connect to the elasticsearch **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [February 15, 2023, 2:33am UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523 "2023-02-15T02:33:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Roy176](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roy176/32/116996_2.png) [@Roy176](https://discuss.elastic.co/u/Roy176)\ **Post date:** [February 15, 2023, 2:33am UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523/1 "2023-02-15T02:33:43Z")
I build a **single-node of elasticsearch on GCP** and **a logstash on the local side**. I want to connect the output configuration of logstash to elasticsearch. Info: Elasticsearch、Kibana、Logstash: 8.6.1. I set up an extenal IP on GCP via static. **1. Create CA** 1-1. Create `ssl.yml` ```auto vi ssl.yml instances: - name: "poc-elk" ip: - "" - "" - "" dns: - "" - "" ``` 1-2. Create ca ```auto /usr/share/elasticsearch/bin/elasticsearch-certgen --dn 'CN=elk-ca' --days 7300 --keysize 4096 --in /etc/elasticsearch/certs/ssl.yml --out /etc/elasticsearch/certs/ssl.zip ``` 1-3. unzip `ssl.zip` and the catalog structure. ```auto Archive: ssl.zip creating: ca/ inflating: ca/ca.crt inflating: ca/ca.key creating: poc-elk/ inflating: poc-elk/poc-elk.crt inflating: poc-elk/poc-elk.key ``` **2. elasticsearch.yml on GCP** ```auto cluster.name: elk node.name: node-1 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch xpack.security.enabled: true xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 xpack.security.transport.ssl: enabled: true verification_mode: certificate key: /etc/elasticsearch/poc-elk.key certificate: /etc/elasticsearch/poc-elk.crt certificate_authorities: /etc/elasticsearch/ca.crt cluster.initial_master_nodes: ["node-1"] http.host: 0.0.0.0 ``` **3. logstash.yml on local side** ```auto node.name: lgs path.data: /var/lib/logstash path.logs: /var/log/logstash ``` **4. logstash output** ```auto less /etc/logstash/conf.d/file-test.conf input{ file{ path => "/etc/logstash/conf.d/file-test.txt" } } output{ elasticsearch{ hosts => [":9200"] user => "elastic" password => "" ssl => true cacert => "/etc/logstash/certs/ca.crt" } } ``` Test: ```auto echo -n "test123" > /etc/logstash/conf.d/file-test.txt ``` **5. Logstash Error messages** ```auto less /var/log/logstash/logstash-plain.log [2023-02-14T17:49:48,450][INFO][logstash.outputs.elasticsearch][file-test] Failed to perform request {:message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :exception=>Manticore::ClientProtocolException, :cause=>#} [2023-02-14T17:49:48,462][WARN][logstash.outputs.elasticsearch][file-test] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://elastic:xxxxxx@:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2023-02-14T17:49:48,749][WARN][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>34, "name"=>"[file-test]>worker0", "current_call"=>"[...]/vendor/bundle/jruby/2.6.0/gems/stud-0.0.23/lib/stud/interval.rb:95:in `sleep'"}, {"thread_id"=>35, "name"=>"[file-test]>worker1", "current_call"=>"[...]/vendor/bundle/jruby/2.6.0/gems/stud-0.0.23/lib/stud/interval.rb:95:in `sleep'"}]}} ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 15, 2023, 6:04am UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523/2 "2023-02-15T06:04:48Z")
[quote="Roy176, post:1, topic:325523"][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}` [/quote] You have issue with keys. ```auto creating: ca/ inflating: ca/ca.crt inflating: ca/ca.key creating: poc-elk/ inflating: poc-elk/poc-elk.crt inflating: poc-elk/poc-elk.key ``` The poc ca files were extracted in a subdirectory. Should be or move the ca files in /etc/elasticsearch/: ```auto key: /etc/elasticsearch/poc-elk/poc-elk.key certificate: /etc/elasticsearch/poc-elk/poc-elk.crt certificate_authorities: /etc/elasticsearch/poc-elk/ca.crt ``` ---
**Author:** ![Roy176](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roy176/32/116996_2.png) [@Roy176](https://discuss.elastic.co/u/Roy176)\ **Post date:** [February 15, 2023, 7:29am UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523/3 "2023-02-15T07:29:48Z")
> [@Roy176](#): > > `unable to find valid certification path to requested target` @Rios Thanks for your reply. The error message is on the local site logstash, so I don't think changing the location of the elasticsearch certificate on GCP is valid. ---
**Author:** ![bshaw](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@bshaw](https://discuss.elastic.co/u/bshaw)\ **Post date:** [February 15, 2023, 8:47pm UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523/4 "2023-02-15T20:47:53Z")
I think the 2nd line of your Logstash error messages may be your problem, "Elasticsearch Unreachable: [https://\:9200/]". From your Logstash host, can you manually curl to that URL using the "-v" and "-k" options? The "-k" skips certificate checks and assumes they are valid. So, that should tell you whether it is routing or certificates or something else. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 15, 2023, 8:48pm UTC](https://discuss.elastic.co/t/logstash-the-output-configuration-of-logstash-cannot-connect-to-the-elasticsearch/325523/5 "2023-03-15T20:48:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.