# Securing communications between Beats and Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [June 5, 2018, 1:32pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631 "2018-06-05T13:32:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![TheNmaptomyHeartBeat](https://avatars.discourse-cdn.com/v4/letter/t/47e85d/32.png) [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Post date:** [June 5, 2018, 1:32pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631/1 "2018-06-05T13:32:33Z")
I have been trying to do this for while now. I have my Elasticsearch cluster with X-Pack on it. I am receiving logs from multiple Beats from multiple other servers to my cluster. Is there a way to encrypt that traffic from Beats to my ES cluster? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 5, 2018, 1:43pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631/2 "2018-06-05T13:43:41Z")
Hi, Yes, you can use TLS. For instance you can take a look at how you can setup [filebeat to send to Elasticsearch or Logstash over TLS](https://www.elastic.co/guide/en/beats/filebeat/current/securing-filebeat.html) or here for configuring [packetbeat to talk to Elasticsearch over TLS](https://www.elastic.co/guide/en/beats/packetbeat/current/elasticsearch-output.html) These should be enough to get you started, but feel free to come back with more specific questions and a little more detail on your setup/architecture if you have any specific issues down the line. ---
**Author:** ![TheNmaptomyHeartBeat](https://avatars.discourse-cdn.com/v4/letter/t/47e85d/32.png) [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Post date:** [June 5, 2018, 1:58pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631/3 "2018-06-05T13:58:00Z")
I've been using X-Pack to generate certificates for the clusters. would I have to generate my own certificate for the servers that have Beats but no X-Pack? And if so, will a self signed certificate work? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 5, 2018, 2:09pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631/4 "2018-06-05T14:09:14Z")
If you want to enable TLS client authentication for filebeat , you would need to generate a key and a certificate that is trusted by the CA that you're using for your Elasticsearch cluster. So - using the same tooling ( I assume you use `certutil` when you say `using X-Pack to generate certificates` ) would be the easiest way and - no, self signed certificates will not work for TLS client authentication[1] . They have to be signed by a CA that Elasticsearch nodes trust. Please go through our documentation, I believe it's detailed enough and will help you get an idea of what is required. If you have any issues with any specific point, please say so and let us also know how it specifically relates to the architecture you are using/want to use. [1] Theoretically, you could use self-signed certificates and add the certificates themselves in the list of CAs that your Elasticsearch nodes trust, but that;s hardly ever a good solution. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2018, 2:09pm UTC](https://discuss.elastic.co/t/securing-communications-between-beats-and-elasticsearch/134631/5 "2018-07-03T14:09:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.