# Lumberjack fails afeter updating to 7.5.2

**URL:** <https://discuss.elastic.co/t/lumberjack-fails-afeter-updating-to-7-5-2/217228>\
**Category:** Logstash\
**Created:** [January 30, 2020, 3:32pm UTC](https://discuss.elastic.co/t/lumberjack-fails-afeter-updating-to-7-5-2/217228 "2020-01-30T15:32:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joao\_Neves](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Joao\_Neves](https://discuss.elastic.co/u/Joao_Neves)\
**Post date:** [January 30, 2020, 3:32pm UTC](https://discuss.elastic.co/t/lumberjack-fails-afeter-updating-to-7-5-2/217228/1 "2020-01-30T15:32:51Z")

</div>

Hello,

After updating ELK stack from 7.4.2 to 7.5.2 _lumberjack_ communication stopped working appropriately. Other kind of communications still works (i.e syslog). A simplified overview of my architecture:

subsidiary\_beat’s à subsidiary\_logstash à Internet à holding\_logstash à holding\_elasticsearch

Other kind of communications still works appropriately. For instance, on subsidiary\_logstash I deployed an agent that fetches events from a cloud provider and forwards it through syslog to honding\_logstash.

Some information:

- First I updated Elasticsearch, then Kibana, finally Logstash;
- Before the update I did not have any issues with lumberjack or any kind of event/communication;
- Subsidiary\_logstash OS is Ubuntu server 18.04
- Holding\_logstash OS is Oracle Linux 7.7
- All logstash OS are updated;
- Those logstash do not run over/on docker
- I did an fresh installation of holding\_logstash and still no success;

The annoying and disturbing error message displayed in holding\_logstash is:

> "[2020-01-28T16:04:40,847][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:8043, remote: 10.53.0.1:1988] Handling exception: javax.net.ssl.SSLHandshakeException: error:100000b8:SSL routines:OPENSSL\_internal:NO\_SHARED\_CIPHER"

---

<div class="post-metadata">

**Author:** ![Joao\_Neves](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Joao\_Neves](https://discuss.elastic.co/u/Joao_Neves)\
**Post date:** [January 30, 2020, 8:46pm UTC](https://discuss.elastic.co/t/lumberjack-fails-afeter-updating-to-7-5-2/217228/2 "2020-01-30T20:46:21Z")

</div>

I solved it.

tl;dr

input {  
beats {  
id =\> "siem-tvg-winlogbeat-01"  
codec =\> json  
port =\> 8043  
ssl =\> true  
ssl\_certificate =\> "/etc/logstash/conf.d/lumberjack.cert"  
ssl\_key =\> "/etc/logstash/conf.d/lumberjack.key"  
cipher\_suites =\> ["TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256","TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384","TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384"]  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2020, 8:46pm UTC](https://discuss.elastic.co/t/lumberjack-fails-afeter-updating-to-7-5-2/217228/3 "2020-02-27T20:46:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.