Lumberjack fails afeter updating to 7.5.2

Elastic Stack Logstash
1

Hello,

After updating ELK stack from 7.4.2 to 7.5.2 lumberjack communication stopped working appropriately. Other kind of communications still works (i.e syslog). A simplified overview of my architecture:

subsidiary_beat’s à subsidiary_logstash à Internet à holding_logstash à holding_elasticsearch

Other kind of communications still works appropriately. For instance, on subsidiary_logstash I deployed an agent that fetches events from a cloud provider and forwards it through syslog to honding_logstash.

Some information:

  • First I updated Elasticsearch, then Kibana, finally Logstash;
  • Before the update I did not have any issues with lumberjack or any kind of event/communication;
  • Subsidiary_logstash OS is Ubuntu server 18.04
  • Holding_logstash OS is Oracle Linux 7.7
  • All logstash OS are updated;
  • Those logstash do not run over/on docker
  • I did an fresh installation of holding_logstash and still no success;

The annoying and disturbing error message displayed in holding_logstash is:

"[2020-01-28T16:04:40,847][INFO ][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:8043, remote: 10.53.0.1:1988] Handling exception: javax.net.ssl.SSLHandshakeException: error:100000b8:SSL routines:OPENSSL_internal:NO_SHARED_CIPHER"

2

I solved it.

tl;dr

input {
beats {
id => "siem-tvg-winlogbeat-01"
codec => json
port => 8043
ssl => true
ssl_certificate => "/etc/logstash/conf.d/lumberjack.cert"
ssl_key => "/etc/logstash/conf.d/lumberjack.key"
cipher_suites => ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"]
}
}

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.