# Problème connection filebeat

**URL:** <https://discuss.elastic.co/t/probleme-connection-filebeat/257870>\
**Category:** Discussions en français\
**Created:** [December 7, 2020, 3:04pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870 "2020-12-07T15:04:30Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![f.boer](https://avatars.discourse-cdn.com/v4/letter/f/e79b87/32.png) [@f.boer](https://discuss.elastic.co/u/f.boer)\
**Post date:** [December 7, 2020, 3:04pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/1 "2020-12-07T15:04:30Z")

</div>

bonjour

je viens d'installer une version 7.10 d'elasticsearch pour pouvoir récupérer et stocker mes logs de firewall fortinet. Après recherche, il s'avère qu'il existe un module filebeat tout pret pour cela. j'ai installé Filebeat et essayais de sécurisé le tout mais impossible de faire communiquer Filebeat avec Elasticsearch en https.  
J'ai essayé avec les documentation de créer un API, cela fonctionne parfaitement en ligne de commande avec un curl mais dès que je l'insère dans le fichier yml cela ne fonctionne pas

voici l'output de mon fichier

```auto
output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  protocol: "https"
  ssl.cetificate: "/etc/filebeat/certs/http.p12"
  ssl.certificat_authorities : ["/etc/filebeat/certs/elasticsearch-ca.pem"]
  ssl.verification_mode: none

  api_key: 
"bjhKOExuWUI3WG1WcEYyeG5NRE06WGdudEhMQkVRTVdHa190X3ZKNEpvQQ=="

```

voici l'erreur remonté par le service

```auto
 ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://elasticsearch:9200)): 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

```

merci d'avance

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 7, 2020, 3:08pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/2 "2020-12-07T15:08:03Z")

</div>

Y a t'il vraiment une ligne vide avant `api_key`?

---

<div class="post-metadata">

**Author:** ![f.boer](https://avatars.discourse-cdn.com/v4/letter/f/e79b87/32.png) [@f.boer](https://discuss.elastic.co/u/f.boer)\
**Post date:** [December 7, 2020, 3:13pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/3 "2020-12-07T15:13:14Z")

</div>

merci pour votre réponse rapide  
mais non il y a juste un espace en le : et le début de la clé, c'est un larsen du copier coller

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 7, 2020, 3:13pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/4 "2020-12-07T15:13:16Z")

</div>

Et je ne sais pas si tu peux vraiment utiliser les deux: API et ssl... Aucune idée...

---

<div class="post-metadata">

**Author:** ![f.boer](https://avatars.discourse-cdn.com/v4/letter/f/e79b87/32.png) [@f.boer](https://discuss.elastic.co/u/f.boer)\
**Post date:** [December 7, 2020, 3:18pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/5 "2020-12-07T15:18:53Z")

</div>

je viens de faire la manipulation en ne laissant que l'url, le protocole et l'API  
voici l'erreur

```auto
 ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://elasticsearch:9200)): Get "https://elasticsearch:9200": x509: certificate signed by unknown authority

```

---

<div class="post-metadata">

**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\
**Post date:** [December 7, 2020, 3:31pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/6 "2020-12-07T15:31:55Z")

</div>

Pourquoi tu utilises ' **l'API key authentication** et **PKI certificate authentication** en meme temps ?

De plus, je pense que c'est plutot : (sans les " ")

```
 protocol: https
```

---

<div class="post-metadata">

**Author:** ![f.boer](https://avatars.discourse-cdn.com/v4/letter/f/e79b87/32.png) [@f.boer](https://discuss.elastic.co/u/f.boer)\
**Post date:** [December 7, 2020, 3:50pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/7 "2020-12-07T15:50:14Z")

</div>

bonjour

si je change ma config en

```
output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  protocol: https
  #ssl.cetificate: "/etc/filebeat/certs/http.p12"
  #ssl.certificat_authorities : ["/etc/filebeat/certs/elasticsearch-ca.pem"]
 # ssl.verification_mode: none

  api_key: "bjhKOExuWUI3WG1WcEYyeG5NRE06WGdudEhMQkVRTVdHa190X3ZKNEpvQQ=="

```

le service me remonte une erreur

`ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://elasticsearch:9200)): Get "https://elasticsearch:9200": x509: certificate signed by unknown authority`

---

<div class="post-metadata">

**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\
**Post date:** [December 7, 2020, 5:57pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/8 "2020-12-07T17:57:27Z")

</div>

Tu as moyen de vérifie si le certificat est valide ?

---

<div class="post-metadata">

**Author:** ![f.boer](https://avatars.discourse-cdn.com/v4/letter/f/e79b87/32.png) [@f.boer](https://discuss.elastic.co/u/f.boer)\
**Post date:** [December 10, 2020, 4:29pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/9 "2020-12-10T16:29:49Z")

</div>

bonjour  
merci pour vos echanges, j'ai résolu mon problème en utilisant non pas le certificat mais le couple autorisation/mot de passe

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2021, 4:29pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870/10 "2021-01-07T16:29:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.