# Logstash upgrade issue **URL:** \ **Category:** Logs\ **Created:** [February 13, 2024, 10:56am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154 "2024-02-13T10:56:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mansoorpn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mansoorpn/32/122338_2.png) [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\ **Post date:** [February 13, 2024, 10:56am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/1 "2024-02-13T10:56:47Z")
Hello Team, We have an IOT device and the logs generated from this device are received by a logstash instance as input and sent the same logs to the cloudamqp queue as output. Working condition -- \> Logstash version 6.8.22 Not working --\> Today, we upgraded Logstash to 7.17.5 and the issue started with the below error. We are using a helm chart to deploy the application in our EKS cluster " {:exception=\>Java::JavaxNetSsl::SSLException, :message=\>"Unsupported or unrecognized SSL message"}" When we searched about this issue, some docs said about the wrong protocol we are using with the logstash config. But, we are not sure, what change we need to make to fix this Any idea, what could be the issue? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 13, 2024, 11:42am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/2 "2024-02-13T11:42:27Z")
Welcome to the community. Are you using FB to forward logs to LS? Where are you using SSL? Input or output? Would be useful to see input or output from .conf ---
**Author:** ![mansoorpn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mansoorpn/32/122338_2.png) [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\ **Post date:** [February 13, 2024, 12:00pm UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/3 "2024-02-13T12:00:41Z")
Hello Rios Rsyslog is running the test devices, collects the logs from the device, and sends them to the Rsyslog Logstash service in **EKS** ```auto logstash.conf: | input { tcp { port => 5140 type => "device-logs" ssl_enable => "true" tcp_keep_alive => "true" ssl_cert => "/etc/pki/logstash/syslog-listener.crt" ssl_key => "/etc/pki/logstash/syslog-listener.key" ssl_extra_chain_certs => ["/etc/pki/logstash/syslog-listener-ca.crt"] ssl_certificate_authorities => ["/etc/pki/logstash/syslog-listener-ca.crt"] } } filter { } output { rabbitmq { vhost => "device" host => "xxxxx" ssl => true exchange => "logs" exchange_type => "x-consistent-hash" passive => true user => "${RABBITMQ_USERNAME}" password => "${RABBITMQ_PASSWORD}" key => "%{+SSS}" # Hashing Key based on the current fraction of a second } } ``` logstash.yml file ```auto logstashConfig: logstash.yml: | http.host: "0.0.0.0" xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.hosts: "${ELASTICSEARCH_URL}" xpack.monitoring.elasticsearch.username: ${ELASTICSEARCH_USERNAME} xpack.monitoring.elasticsearch.password: ${ELASTICSEARCH_PASSWORD} xpack.monitoring.collection.pipeline.details.enabled: true path.config: /usr/share/logstash/pipeline pipeline.id: devicelogs-rsyslog-amqp-upload log.level: warn ``` The above configuration is working fine with logsatsh 6.8.22 and failing with logasth 7.17.5 ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 13, 2024, 12:07pm UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/4 "2024-02-13T12:07:19Z")
Most likely TLSv1.3 version cause an issue. Try to downgrade the input or upgrade TLS to at least 1.2 on Rsyslog side. Check [this](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html#plugins-inputs-tcp-ssl_supported_protocols) There is also possibility to set _ssl\_version_ on the rabbitmq plugin, however I would check first the input settings. ---
**Author:** ![mansoorpn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mansoorpn/32/122338_2.png) [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\ **Post date:** [February 13, 2024, 2:00pm UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/5 "2024-02-13T14:00:02Z")
Hello Rios, Thank you for the update. We will take a look and update here ---
**Author:** ![mansoorpn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mansoorpn/32/122338_2.png) [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\ **Post date:** [February 14, 2024, 8:15am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/6 "2024-02-14T08:15:59Z")
Hello Rios, The issue was with the Cloudamqp port. We were using the default port 5672 instead of TLS port 5671. I have explicitly added that port to the output section and now it's working fine 1. Change ```auto output { rabbitmq { port => 5671 *This TLS port added here to fix the issue* vhost => "device" host => "xxxxx" ssl => true exchange => "logs" exchange_type => "x-consistent-hash" passive => true user => "${RABBITMQ_USERNAME}" password => "${RABBITMQ_PASSWORD}" key => "%{+SSS}" # Hashing Key based on the current fraction of a second } } ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 14, 2024, 8:33am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/7 "2024-02-14T08:33:00Z")
Excellent. Thank you for feedback. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 13, 2024, 8:33am UTC](https://discuss.elastic.co/t/logstash-upgrade-issue/353154/8 "2024-03-13T08:33:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.