# Security between filebeat and logstash

**URL:** <https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 14, 2017, 1:32pm UTC](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523 "2017-03-14T13:32:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patrik\_Soderstrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrik_soderstrom/32/53928_2.png) [@Patrik\_Soderstrom](https://discuss.elastic.co/u/Patrik_Soderstrom)\
**Post date:** [March 14, 2017, 1:32pm UTC](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523/1 "2017-03-14T13:32:33Z")

</div>

Hi,  
I have setup ELK-stack without X-pack and it works great. Data is getting in to logstash and then sent to elasticsearch.  
Now I wanted to add security so I have added x-pack to Elasticsearch, Kibana and Logstash. I can login to Kibana so the Elasticsearch and Kibana works well with security.

But when it comes to Filebeat and logstash I get problem.

First off, can I have Filebeat send information to Logstash without authentication? SSL off?  
I get the below error message in Filebeat  
`Failed to publish events caused by: write tcp x.x.x.x:59939->x.x.x.x:5044: wsasend: An existing connection was forcibly closed by the remote host.`

Do I need to use SSL authentication between Logstash and Filebeat?

Thanks for replies.

---

<div class="post-metadata">

**Author:** ![giuseppe](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@giuseppe](https://discuss.elastic.co/u/giuseppe)\
**Post date:** [March 15, 2017, 5:20pm UTC](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523/2 "2017-03-15T17:20:10Z")

</div>

Hi Patrik,

Do you have SSL disabled in both the [filebeat output](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html#_ssl_2) and the [Logstash input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-ssl)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2017, 5:20pm UTC](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523/3 "2017-04-12T17:20:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.