# Migration of LSF to filebeat

**URL:** <https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 6, 2016, 8:38am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493 "2016-04-06T08:38:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![NiteshBarnwal](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\
**Post date:** [April 6, 2016, 8:38am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493/1 "2016-04-06T08:38:20Z")

</div>

I am trying to migrate logstash-forwarder to filebeat. getting certificate error in filebeat though same is being used in logstash-forwarder. I have changed the template and the index is good with %type.  
logstash version is 2.2.0 and filebeat is 1.2. Can anyone help?  
My running logstash-forwarder configuration is as below:

```
{
  "network": {
  "servers": ["ELK_IP:6551"],
  "ssl ca": "/opt/logstash-forwarder/cert/server.crt",
  "timeout": 30
  },
 "files": [
   {
    "paths": ["/opt/logstash-forwarder/status.log"],
    "fields": {
          "type": "status" }
   }
  ]
}

```

and output as:

```
input {
  lumberjack {
    port => 6551
    ssl_certificate => "/installdir/ELK/logstash-1.5.4/cert/vm-fead-server.crt"
    ssl_key => "/installdir/ELK/logstash-1.5.4/cert/vm-fead-server.key"
  }
}
filter {
if [type] == "status" {
  grok {
    match => ["message", "%{DATESTAMP:datestamp} %{GREEDYDATA:name} %{WORD:status}"]
  }
}
}
output {
    elasticsearch {
        action => "index"
        hosts => "localhost:9200"
        index => "%{type}"
        workers => 1
        manage_template => false
        template_overwrite => true
        template => "/installdir/ELK/logstash-2.2.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.4.1-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json"
    }
     stdout {
         codec => json
     }
}

```

I am trying with below filebeat conf

```
filebeat:
  prospectors:
    -
      paths:
        - /etc/filebeat/logs/*.log
      input_type: log
      document_type: status
  registry_file: /etc/filebeat/registry
output:
  logstash:
    hosts: ["ELK_IP:5044"]
    timeout: 15
    tls:
      certificate: "/etc/filebeat/cert/server.crt"
      certificate_key: "/etc/filebeat/cert/server.key"
  file:
    path: "/etc/filebeat/log/filebeat"
    number_of_files: 3
shipper:
  ignore_outgoing: true
logging:
  files:
    path: /etc/filebeat/log/mybeat
    rotateeverybytes: 10485760 # = 10MB
    keepfiles: 3

```

output as:

```
input {
  beats {
    port => 5044
    ssl_certificate => "/installdir/ELK/beat/cert/server.crt"
    ssl_key => "/installdir/ELK/beat/cert/server.key"
    ssl => true
  }
}

filter {
if [type] == "status" {
  grok {

    match => ["message", "%{DATESTAMP:datestamp} %{NUMBER:utilization:int} %{GREEDYDATA:partition}"]
  }
}
}
output {
  stdout { codec => rubydebug }
  elasticsearch {
    action => "index"
    hosts => "localhost:9200"
    manage_template => false
    template_overwrite => true
    template => "/installdir/ELK/logstash-2.2.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-2.4.1-java/lib/logstash/outputs/elasticsearch/elasticsearch-template.json"
    index => "%{[@metadata][type]}"
    document_type => "%{[@metadata][type]}"
  }
}

```

The error that i am getting is `Starting filebeat: 2016/04/06 07:38:39.473521 transport.go:125: ERR SSL client failed to connect with: x509: certificate signed by unknown authority`

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 6, 2016, 11:06am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493/2 "2016-04-06T11:06:22Z")

</div>

In logstash you have to configure server certificate + private key and in filebeat the certificate\_authorities (certificate containing public key only). You sample configs configure certificate + private key in logstash and filebeat without any certificate authority.

In filebeat:

```auto
output:
  logstash:
    hosts: ["ELK_IP:5044"]
    timeout: 15
    tls:
      certificate_authorities: ["/etc/filebeat/cert/server.crt"]

```

Should do the trick. Please remove private key from filebeat machine.

---

<div class="post-metadata">

**Author:** ![NiteshBarnwal](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\
**Post date:** [April 7, 2016, 9:18am UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493/3 "2016-04-07T09:18:34Z")

</div>

Thank you! it worked this time. I tried with the same parameter, may be I was having some typo.

See you soon on next thread 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/migration-of-lsf-to-filebeat/46493/4 "2017-07-05T21:53:42Z")

</div>