# Secure auditbeat output

**URL:** <https://discuss.elastic.co/t/secure-auditbeat-output/243448>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 2, 2020, 8:29am UTC](https://discuss.elastic.co/t/secure-auditbeat-output/243448 "2020-08-02T08:29:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elk6/32/72282_2.png) [@elk6](https://discuss.elastic.co/u/elk6)\
**Post date:** [August 2, 2020, 8:29am UTC](https://discuss.elastic.co/t/secure-auditbeat-output/243448/1 "2020-08-02T08:29:58Z")

</div>

I have logstash listening for encrypted data. If I set auditbeat output to logstash with ssl, I won't find the data later in elasticsearch. If I set auditbeat output to elasticsearch, I can't get it to encrypt data.

This is my output.elasticsearch in my auditbeat.yml : [https://pastebin.com/1dpSBrx7](https://pastebin.com/1dpSBrx7) ( I copied it from my `filebeat.yml` in `output.logstash` which does work)

Does anyone know happen to know why it doesn't send encrypted data? Or why if I set auditbeat output to logstash, it won't appear in ES?

Huge thanks ahead.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 3, 2020, 10:22pm UTC](https://discuss.elastic.co/t/secure-auditbeat-output/243448/2 "2020-08-03T22:22:46Z")

</div>

It's easier for people to help you if you keep a single topic on your problem 🙂  
Let's continue the discussion here - [Auditbeat encryption and dashboards](https://discuss.elastic.co/t/auditbeat-encryption-and-dashboards/243423)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 3, 2020, 10:22pm UTC](https://discuss.elastic.co/t/secure-auditbeat-output/243448/3 "2020-08-03T22:22:50Z")

</div>


