# Logstash to Elasticsearch - SSL Connection Error **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [July 3, 2019, 12:54pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-error/188714 "2019-07-03T12:54:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Paul\_14](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@Paul\_14](https://discuss.elastic.co/u/Paul_14)\ **Post date:** [July 3, 2019, 12:54pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-error/188714/1 "2019-07-03T12:54:27Z")
Hello, I am attempting to enable SSL encryption between Logstash and Elasticsearch but on restarting my logstash node, I receive error: > ``` > [2019-07-03T12:36:42,992][DEBUG][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://logstash_writer:xxxxxx@espdata1:9200/, :path=>"/"} > [2019-07-03T12:36:43,003][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_writer:xxxxxx@espdata1:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'https://espdata1:9200/'"} > [2019-07-03T12:36:43,003][DEBUG][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>https://logstash_writer:xxxxxx@espdata2:9200/, :path=>"/"} > [2019-07-03T12:36:43,012][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_writer:xxxxxx@espdata2:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_writer:xxxxxx@espdata2:9200/][Manticore::SocketException] Connection refused (Connection refused)"} > > ``` I have enabled HTTP encryption in my three Elasticsearch nodes as per elasticsearch.yml snippet below. My SSL certificates are generated by an internal CA. > ``` > xpack.security.transport.ssl.enabled: true > xpack.security.transport.ssl.verification_mode: none > xpack.security.transport.ssl.key: config/espdata0.key > xpack.security.transport.ssl.certificate: config/espdata0.crt > xpack.security.transport.ssl.certificate_authorities: ["/etc/elasticsearch/config/CARoot.crt","/etc/elasticsearch/config/CAIntermediate.crt"] > > xpack.security.http.ssl.enabled: true > xpack.security.http.ssl.key: config/espdata0.key > xpack.security.http.ssl.certificate: config/espdata0.local.crt > xpack.security.http.ssl.certificate_authorities: ["/etc/elasticsearch/config/CARoot.crt","/etc/elasticsearch/config/CAIntermediate.crt"] > > ``` In Logstash, I have configured the below in my .conf file output filter. I set certificate verification to 'false' after reading some other posts related to issues with certificates that were generated from an internal CA... In the cacert field I also tried '/etc/logstash/config/CARoot.crt' but had the same outcome. > output { > elasticsearch { > > ``` > hosts => ["espdata0:9200","espdata1:9200","espdata2"] > index => "meterflow-%{+YYYY.MM.dd}" > user => "logstash_writer" > password => "Elastic$tack" > ssl => true > ssl_certificate_verification => false > cacert => "/etc/logstash/config/CAIntermediate.crt" > } > } > > ``` In logstash.yml I have set monitoring to false: > xpack.monitoring.enabled: false Can anyone suggest where I may be going wrong here? Thanks, Paul ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 3, 2019, 1:27pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-error/188714/2 "2019-07-03T13:27:52Z")
It looks like there is an issue with your `logstash_writer` user and not with TLS. Please share some additional information. Can you reach all `espdata0`, `espdata1`, `espdata2` nodes from the machine where logstash is running? Did you follow [this documentation](https://www.elastic.co/guide/en/logstash/current/ls-security.html) Have you created this user in elasticsearch with the appropriate roles ? Can you verify the password is correct ? i.e. try the [authenticate API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html) ```auto curl -u logstash_writer 'https://espdata2:9200/_security/_authenticate' ``` and share the output with us. ---
**Author:** ![Paul\_14](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@Paul\_14](https://discuss.elastic.co/u/Paul_14)\ **Post date:** [July 3, 2019, 2:48pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-error/188714/3 "2019-07-03T14:48:30Z")
Hi Ikakavas, First off, there was a mistake on my part. My user is logstash\_internal - which has the role logstash\_writer. So I tried your instruction with logstash\_internal. ``` > curl -u logstash_internal 'https://espdata0:9200/_security/_authenticate' > Enter host password for user 'logstash_internal': > curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none > More details here: http://curl.haxx.se/docs/sslcerts.html > > curl performs SSL certificate verification by default, using a "bundle" > of Certificate Authority (CA) public keys (CA certs). If the default > bundle file isn't adequate, you can specify an alternate file > using the --cacert option. > If this HTTPS server uses a certificate signed by a CA represented in > the bundle, the certificate verification probably failed due to a > problem with the certificate (it might be expired, or the name might > not match the domain name in the URL). > If you'd like to turn off curl's verification of the certificate, use > the -k (or --insecure) option. ``` I then tried it with the --cacert argument with gave a healthier response: ``` curl --cacert CAIntermediate.crt -u logstash_internal 'https://espdata0:9200/_security/_authenticate' Enter host password for user 'logstash_internal': {"username":"logstash_internal","roles":["logstash_writer"],"full_name":"Internal Logstash User","email":null,"metadata":{},"enabled":true,"authentication_realm":{"name":"default_native","type":"native"},"lookup_realm":{"name":"default_native","type":"native"}}root@esp-logstash:/etc/logstash/config# ``` I also updated my logstash output filter to use the logstash\_internal user... Upon restarting, this resolved the issue. I was spending a lot of time looking into SSL configuration and not the native user authentication. Thanks again for you reply. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 31, 2019, 2:48pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-ssl-connection-error/188714/4 "2019-07-31T14:48:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.