# Lostash and arcsight integration

**URL:** https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434
**Category:** Logstash
**Created:** [September 3, 2020, 6:26pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434 "2020-09-03T18:26:50Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 3, 2020, 6:26pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/1 "2020-09-03T18:26:50Z")

</div>

unable to configure smart connector on logstash

content of logstash.yml

modules:

- name: arcsight  
var.input.eventbroker.bootstrap\_servers: "XXXX.XXXXXX.XXXXX:1515"  
var.input.eventbroker.topics: "eb\_topic"  
var.elasticsearch.hosts: "10.XXX.XXX.XXX:9200"  
var.elasticsearch.username: "  
var.elasticsearch.password: "pass"  
var.kibana.host: "10.XXX.XXX.XXX:443"  
var.kibana.username: "\<user"\>  
var.kibana.password: "pass"

# 

i am getting below error while setting up arcsight module

[2020-09-03T20:04:58,280][INFO][logstash.config.modulescommon] Setting up the arcsight module  
[2020-09-03T20:04:58,605\*][ERROR][logstash.modules.kibanaclient] Error when executing Kibana client request {:error=\>#\<Manticore::ClientProtocolException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target\>}\*  
_[2020-09-03T20:04:58,744][ERROR][logstash.modules.kibanaclient] Error when executing Kibana client request {:error=\>#\<Manticore::ClientProtocolException: PKIX path building failed: sun.security.provider.certpath.SunC_ertPathBuilderException: unable to find valid certification path to requested target\>}  
[2020-09-03T20:04:58,846][ERROR][logstash.config.sourceloader] Could not fetch all the sources {:exception=\>LogStash::ConfigLoadingError, :message=\>"Failed to import module configurations to Elasticsearch and/or Kibana. Module: arcsight has Elasticsearch hosts: ["XX.XXXX.XXXX:9200"] and Kibana hosts: ["XX.XXXX.XXXX:443"]", :backtrace=\>["/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/config/modules\_common.rb:108:in `block in pipeline_configs'", "org/jruby/RubyArray.java:1814:in `each'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/config/modules\_common.rb:54:in `pipeline_configs'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/config/source/modules.rb:14:in `pipeline\_configs'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/config/source\_loader.rb:61:in `block in fetch'", "org/jruby/RubyArray.java:2575:in `collect'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/config/source\_loader.rb:60:in `fetch'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/agent.rb:149:in `converge\_state\_and\_update'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/agent.rb:97:in `execute'", "/tools/logstash/logstash-7.6.2/logstash-core/lib/logstash/runner.rb:369:in `block in execute'", "/tools/logstash/logstash-7.6.2/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 3, 2020, 6:41pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/2 "2020-09-03T18:41:26Z")

</div>

> [@sidhesh\_kumar](#):
>
> ][logstash.modules.kibanaclient] Error when executing Kibana client request {:error=\>#\<Manticore::ClientProtocolException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target\>}\*

OK, so it is unable to validate the certificate that is served by the kibana instance. Try setting var.kibana.ssl.certificate\_authority, I believe that wants a .crt file.

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 4, 2020, 5:04am UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/4 "2020-09-04T05:04:30Z")

</div>

appreciate you response @badger , should i put this variable in logstash.yml file?

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 4, 2020, 5:09am UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/5 "2020-09-04T05:09:41Z")

</div>

also , i am not sure if i need to create any logstash.conf file after the archsight module is created on logstash , if so then what would be the content of that would look like , i know how to configure input output section for filebeat listeners but for this i have no idea.  
i want to create a CEF listner on port 1515  
so the steps would be??

1. start arcsight module ??
2. create logstash.conf file ??  
please guide me here.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 4, 2020, 1:23pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/6 "2020-09-04T13:23:29Z")

</div>

> [@sidhesh\_kumar](#):
>
> should i put this variable in logstash.yml file?

Yes.

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 4, 2020, 1:38pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/7 "2020-09-04T13:38:32Z")

</div>

@Badger can you help above query

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 4, 2020, 1:57pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/8 "2020-09-04T13:57:38Z")

</div>

No, I have never used modules.

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 10, 2020, 11:39am UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/9 "2020-09-10T11:39:06Z")

</div>

hi @Badger i think this is due to licencing issue  
curl -u user:pass -X POST "HOST:9200/\_license/start\_basic?pretty"  
`{ "acknowledged" : true, "basic_was_started" : false, "error_message" : "Operation failed: Current license is basic." }`  
what does this response means. is my basic license started , i see its installed but how can i start it , it fails .

curl -u user:pass -X GET "HOST:9200/\_xpack/license"  
`{ "license" : { "status" : "active", "uid" : "0ead494d-da2a-4d5e-99bb-d8f0a997576e", "type" : "basic", "issue_date" : "2020-06-14T14:44:14.396Z", "issue_date_in_millis" : 1592145854396, "max_nodes" : 1000, "issued_to" : "elasticsearch", "issuer" : "elasticsearch", "start_date_in_millis" : -1 } } `

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [September 10, 2020, 12:04pm UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/10 "2020-09-10T12:04:14Z")

</div>

i also see GET /\_license/basic\_status, how can i fix this, i am using basic license

`{ "eligible_to_start_basic": false }`

---

<div class="post-metadata">

### Author: ![sidhesh\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sidhesh_kumar/32/71987_2.png) [@sidhesh\_kumar](https://discuss.elastic.co/u/sidhesh_kumar)
#### Post date: [October 2, 2020, 10:10am UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/11 "2020-10-02T10:10:50Z")

</div>

i just needed to use tcp input in logstash pipeline , its resolved

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 30, 2020, 10:10am UTC](https://discuss.elastic.co/t/lostash-and-arcsight-integration/247434/12 "2020-10-30T10:10:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.