tls_enable: true
tls_key_file: /home/rene/graylog.domain.com.rsa
tls_key_password: ********
```
this is the logstash config:
```
input {
beats {
port => 5050
ssl => true
ssl_certificate => "/home/logstash/certs/agg_hag1.crt"
ssl_key => "/home/logstash/certs/agg_hag1-des-v1.pem"
ssl_key_passphrase => "PWD"
ssl_verify_mode => none
tls_min_version => 1.2
}
}
output {
lumberjack {
id => "internal_POC"
enable_metric => true
hosts => "graylog.domain.com"
port => 5044
ssl_certificate => "/home/logstash/certs/ca-pem.crt"
}
}
```
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [April 2, 2019, 4:09pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/2 "2019-04-02T16:09:28Z")
Reading the Graylog Sidecar docs I get the impression that they have reverse engineered a Beats compatible input as a target for Beats traffic.
The lumberjack output uses the Lumberjack protocol. I know the Logstash beats input understands the Lumberjack protocol but I'm not sure whether the Graylog Sidecar Beats input does - I checked the source and I can't see any ref to Lumberjack the protocol, only the Golang log-rotation package of the same name.
---
### Author:  [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)
#### Post date: [April 3, 2019, 8:55am UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/3 "2019-04-03T08:55:00Z")
Hi @guyboertje!
Thank you for you time! I've been using the Beats input plugin in Graylog itself and i found this code: [https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog/plugins/beats/BeatsFrameDecoder.java](https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog/plugins/beats/BeatsFrameDecoder.java)
So you say, they arent compatible with lumberjack? Then I have to switch to GELF output.
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [April 3, 2019, 9:00am UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/4 "2019-04-03T09:00:02Z")
Ahh, I did not find that code - I only looked in Sidecar.
However, the last change was made one year ago. Perhaps, we made a change to the Lumberjack protocol since then?
I don't think any one here can help much more than this. Perhaps you should try the Graylog folks?
---
### Author:  [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)
#### Post date: [April 3, 2019, 9:02am UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/5 "2019-04-03T09:02:23Z")
Thank you @guyboertje ! I've tried it in the graylog forums, but they say they are compatible ([https://community.graylog.org/t/filebeat-logstash-graylog-all-ssl-secured/9668/9](https://community.graylog.org/t/filebeat-logstash-graylog-all-ssl-secured/9668/9)). But idk, maybe it's less stress and pain when i switch to gelf for the last mile 🙄
Thank you anyway 😃
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [April 3, 2019, 11:43am UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/6 "2019-04-03T11:43:19Z")
There will always be a risk that we change the Lumberjack protocol out of sync with the Graylog implementation - therefore it is better in the long run to use more stable technologies.
Elastic obviously controls the Lumberjack protocol and will ensure that our products using it remain in sync but that can't be guaranteed for 3rd party implementations.
---
### Author:  [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)
#### Post date: [April 3, 2019, 1:58pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/7 "2019-04-03T13:58:17Z")
Hi again, @guyboertje !
Is it officialy supported to do lumberjack -\> beats? I've followed this instruction, but i cant connect bcs of strange ssl errors: [https://www.elastic.co/guide/en/logstash/current/ls-to-ls.html](https://www.elastic.co/guide/en/logstash/current/ls-to-ls.html)
i get sometimes PEER\_DID\_NOT\_RETURN\_A\_CERTIFICATE or SSLV3\_ALERT\_CERTIFICATE\_UNKNOWN
ERRORS:
```
[2019-04-03T15:14:47,320][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5055, remote: 172.21.2.97:49628] Handling exception: javax.net.ssl.SSLHandshakeException: error:100000c0:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
[2019-04-03T15:14:47,323][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:100000c0:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:579) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:496) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_191]
Caused by: javax.net.ssl.SSLHandshakeException: error:100000c0:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.sslReadErrorResult(ReferenceCountedOpenSslEngine.java:1140) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1101) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1169) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1212) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:216) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1297) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.SslHandler.decodeNonJdkCompatible(SslHandler.java:1211) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1245) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
... 16 more
```
my configs:
upstream:
```
output {
lumberjack {
hosts => "agg_hag1.domain.com"
port => 5055
ssl_certificate => "/home/logstash/certs/agg_hag1.crt"
codec => "json"
}
}
```
downstream:
```
input {
beats {
port => 5055
codec => "json"
ssl => true
ssl_certificate => "/home/logstash/certs/agg_hag1.crt"
ssl_certificate_authorities => "/home/logstash/certs/domain-ca-pem.crt"
ssl_key => "/home/logstash/certs/agg_hag1-des-v1.pem"
ssl_key_passphrase => "PWD"
# ssl_verify_mode => none
# tls_min_version => 1.2
}
}
```
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [April 3, 2019, 2:03pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/8 "2019-04-03T14:03:05Z")
Would you mind creating a new discussion thread as this one is marked as solved and the title is not LS -\> LS related?
So other folks can help or get a solution for LS -\> LS.
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [April 3, 2019, 2:12pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/9 "2019-04-03T14:12:52Z")
Or we can work on the other one you commented on [Logstash Lumberjack Cert](https://discuss.elastic.co/t/logstash-lumberjack-cert/174885/4?u=guyboertje)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2019, 2:12pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936/10 "2019-05-01T14:12:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.