# Logstash to elastic output SSL **URL:** \ **Category:** Logstash\ **Created:** [January 23, 2018, 3:36pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703 "2018-01-23T15:36:11Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 23, 2018, 3:36pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/1 "2018-01-23T15:36:11Z")
I have configured SSL for all ELASTIC cluster nodes Blowed if I can find any reliable information regarding how to subsequently configure the logstash output plugin once I restart my ES cluster with ssl enabled. I 'think' I ONLY need the elastic cluster ca.crt and the following lines in the output plugin ssl =\> true cacert =\> /path/to/ca.crt Maybe I should have included the logstash nodes in my gencert run and a logstash server cert and key is required somewhere too? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 23, 2018, 5:25pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/2 "2018-01-23T17:25:55Z")
What did you configure in `elasticsearch.yml` ? There's a number of different possible configurations for SSL in elasticsearch, and the appropriate logstash configuration will be dependent on what changes you made. ---
**Author:** ![GSCully](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gscully/32/26104_2.png) [@GSCully](https://discuss.elastic.co/u/GSCully)\ **Post date:** [January 23, 2018, 7:39pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/3 "2018-01-23T19:39:01Z")
I had to import the ca cert to the Java keystore. try that. keytool -import -alias alias -keystore path-to-jre/lib/security/cacerts -file path-to-certificate-file ---
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 24, 2018, 9:42am UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/4 "2018-01-24T09:42:34Z")
my es clients elasticsearch.yml : after following [https://www.elastic.co/guide/en/x-pack/5.4/ssl-tls.html#installing-node-certificatescluster.name:](https://www.elastic.co/guide/en/x-pack/5.4/ssl-tls.html#installing-node-certificatescluster.name:) [cluster.name](http://cluster.name): [node.name](http://node.name): \<_hostname_\> path.data: _\_ path.logs: _\_ network.host: _eth0_ discovery.zen.ping.unicast.hosts: ["n.n.n.n", "n.n.n.n", "n.n.n.n"] http.port: 9200 bootstrap.memory\_lock: true node.master: false node.data: false node.ingest: true thread\_pool.bulk.size: 3 thread\_pool.bulk.queue\_size: 10000 thread\_pool.index.size: 3 thread\_pool.index.queue\_size: 10000 indices.fielddata.cache.size: 30% xpack.ssl.certificate\_authorities: /etc/_\_ xpack.ssl.certificate: _\_ xpack.security.transport.ssl.enabled: false xpack.security.http.ssl.enabled: false xpack.security.enabled: true action.auto\_create\_index: true xpack.security.audit.enabled: true ---
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 24, 2018, 9:43am UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/5 "2018-01-24T09:43:05Z")
I'm on 5.4 - I didn't use java keystore - I followed the guide at [https://www.elastic.co/guide/en/x-pack/5.4/ssl-tls.html#installing-node-certificates](https://www.elastic.co/guide/en/x-pack/5.4/ssl-tls.html#installing-node-certificates) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 24, 2018, 10:59am UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/6 "2018-01-24T10:59:03Z")
> [@elasticus](#): > > xpack.security.transport.ssl.enabled: false > xpack.security.http.ssl.enabled: false You've disabled SSL on both the transport port and the http port, so you're not actually using SSL at all. If you want Logstash to use SSL you'll need to enable SSL on the http port. ```auto xpack.security.http.ssl.enabled: true ``` Then, what you initially proposed for the Logstash config should be correct, provided that the IP/hostname you entered into `certgen` match your ES node's address. ---
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 24, 2018, 11:41am UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/7 "2018-01-24T11:41:30Z")
Yes I purposely set ssl disabled for the moment whilst working on the Logstash config. The ca cert generated (on one of the es nodes) by certgen created keys and certs for all my es nodes and Logstash nodes plus the ca cert and key It’s the ca.crt required on the Logstash node? Not it’s own cert?  Sent from my iPhone ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 24, 2018, 12:57pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/8 "2018-01-24T12:57:40Z")
> [@elasticus](#): > > Yes I purposely set ssl disabled for the moment whilst working on the Logstash config. Yes, I assumed that was the case, but I wanted to be really clear. > [@elasticus](#): > > It’s the ca.crt required on the Logstash node? Not it’s own cert? It depends on exactly what you're trying to achieve, but yes, it's the CA cert. SSL can be used for 3 things (but doesn't need to do all of them) 1. Confidentiality (Encryption) 2. Server identity 3. Client identity Most of the time only (1) and (2) apply. In a web browser environment, SSL makes sure your connection is encrypted, and the certificate checking makes sure you're connecting to the right server, but it's not normally used to check the identity of the user operating the browser. It _can_ be, but normally you just pass a username + password over the encrypted SSL connection. Logstash is the same. It is the client to the ES server, and you _can_ use a client certificate to establish the identity of the logstash process, but it is more commonly that case that use just use a username + password. That means your logstash process doesn't need its own certificate because it's not trying to establish its own identity via SSL certs. It does, however, need to know how to check the identity of the server. For that it needs a copy of the CA certificate. The CA is the participant that is asserting the identity of the ES server, and the Logstash process needs to trust that CA by being configured with a copy of the CA cert. **If** you to use SSL to eastblish the Logstash process's identity, then you'll need a different configuration on both the Logstash side and the ES side. ---
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 24, 2018, 1:07pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/9 "2018-01-24T13:07:27Z")
So at this stage I only want to encrypt the data in transit between the logstash and the ES so I have enabled SSL on the ES cluster and restarted those nodes and added ssl =\> true cacert =\> /path/to/ca.crt on the logstash nodes output filter I have added nothing to the logstash.yml Now the service starts but no traffic is output logstash.outputs.elasticsearch Attempted to resurrect connection to dead ES instance but got error Got response code '401' contacting Elasticsearch at URL '[https://n.n.n.n:9200/](https://n.n.n.n:9200/) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 24, 2018, 8:48pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/10 "2018-01-24T20:48:54Z")
> [@elasticus](#): > > Got response code '401' contacting Elasticsearch at URL '[https://n.n.n.n:9200/](https://n.n.n.n:9200/) That looks like a consequence of turning on X-Pack security rather than SSL. Sorry, I had assumed you already had the security side working. You need to add [user](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-user) and [password](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-password) to your logstash config. There's a [guide](https://www.elastic.co/guide/en/logstash/6.1/ls-security.html) for Logstash + Elasticsearch X-Pack Security that you might find helpful. ---
**Author:** ![elasticus](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Post date:** [January 24, 2018, 10:26pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/11 "2018-01-24T22:26:57Z")
Authentication is/was already working - already have that configured following aforementioned guide. I figured out the syntax required anyway eventually and will post here tomorrow ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2018, 10:27pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-output-ssl/116703/12 "2018-02-21T22:27:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.