# Metricbeat - Capable of following?
**URL:** https://discuss.elastic.co/t/metricbeat-capable-of-following/68776
**Category:** Beats
**Tags:** metricbeat
**Created:** [December 12, 2016, 9:20pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776 "2016-12-12T21:20:46Z")
**Posts on this page:** 8
**Page:** 2
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 8, 2017, 10:17pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/21 "2017-02-08T22:17:41Z")
What exactly do you mean by client-side encryption?
The transport layer can be encrypted with TLS and Beats support TLS mutual auth.
---
### Author:  [@rherr63](https://discuss.elastic.co/u/rherr63)
#### Post date: [February 8, 2017, 10:35pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/22 "2017-02-08T22:35:45Z")
Encrypting data before it is transmitted to the cloud service provider. In our use case, outputting Metricbeat and Filebeat to a local file and AWS-Kinesis-agent forwarding to AWS Kinesis stream.
---
### Author:  [@rherr63](https://discuss.elastic.co/u/rherr63)
#### Post date: [February 9, 2017, 2:13am UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/23 "2017-02-09T02:13:50Z")
Further explanation....we want the option of not only encrypting the connection but also the payload. So the actual log record becomes an encrypted binary object. The reason for this is that the target cannot encrypt at rest so we need to encrypt prior to transmission ( i.e. client - side ).
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 9, 2017, 2:23pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/24 "2017-02-09T14:23:58Z")
Oh, right makes some sense since you are reading the output file with the Kinesis-agent. (I forgot about that part)
No, you would need to modify the codebase or write a custom output.
---
### Author:  [@rherr63](https://discuss.elastic.co/u/rherr63)
#### Post date: [February 23, 2017, 2:27pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/25 "2017-02-23T14:27:28Z")
Andrew, is there any documentation regarding encryption options for the Beats suite? We have a requirement to client-side encrypt data before sending to Kafka. Looking for info such as,.....do the Metricbeat and Filebeat agents themselves only support a single model for this? Ultimately, we must find a model that both Beats and Kafka support. Thanks in advance!
---
### Author:  [@rherr63](https://discuss.elastic.co/u/rherr63)
#### Post date: [February 23, 2017, 2:34pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/26 "2017-02-23T14:34:43Z")
Oh, one other point. We are **_for the time being_** bypassing the Kinesis agent and going directly from Beats to Kafka. Does this simplify the encryption challenge? Previously, you had written "The transport layer can be encrypted with TLS and Beats support TLS mutual auth.".
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [February 24, 2017, 12:20pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/27 "2017-02-24T12:20:26Z")
Here you can find the docs for the kafka output encryption: [https://www.elastic.co/guide/en/beats/metricbeat/5.2/kafka-output.html#\_ssl\_3](https://www.elastic.co/guide/en/beats/metricbeat/5.2/kafka-output.html#_ssl_3)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 24, 2017, 12:20pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776/28 "2017-03-24T12:20:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
[Previous page](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776.md?page=1)