# Securing communication between Elasticsearch and Filebeat
**URL:** https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467
**Category:** Beats
**Tags:** filebeat
**Created:** [July 25, 2017, 11:04am UTC](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467 "2017-07-25T11:04:37Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@madou23](https://discuss.elastic.co/u/madou23)
#### Post date: [July 25, 2017, 11:04am UTC](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467/1 "2017-07-25T11:04:37Z")
Hi all,
I am running Elasticsearch and Kibana stack 5.5.0 on an ubuntu server. My client servers are located in a local network so I need to run ES on 0.0.0.0:9200 to get logs from Filebeat.
I know it's too risky to expose ES to public, I'm trying to put it behind a reverse proxy (nginx) with access control list with Lua to limit filebeat clients access only to its index.
as described in this article
> **[Playing HTTP Tricks with Nginx
| Elastic](https://www.elastic.co/blog/playing-http-tricks-nginx)**
>
> Update November 2, 2015: If you're interested in advanced access control configuration or other security features, consider taking Shield, security for Elasticsearch, for a spin. One of the defining f...
In other words, is there a way to implement this security role in x-pack using nginx + Lua ?
POST \_xpack/security/role/filebeat\_writer
{
"cluster": ["manage\_index\_templates", "monitor"],
"indices": [
{
"names": ["filebeat-\*"],
"privileges": ["read","write","create\_index"]
}
]
}
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [July 26, 2017, 9:12am UTC](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467/2 "2017-07-26T09:12:18Z")
I'm not sure if that's possible with Nginx, because Filebeat uses the [\_bulk](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html), which allows for arbitrary commands in the body of the message. Even if it were possible, note that that means that anyone could add data to your indices.
Perhaps a slightly better option would be to have Logstash installed centrally, and have Filebeat talk to Logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2017, 9:12am UTC](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467/3 "2017-08-23T09:12:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.