# Send monitoring data Filebeat to HTTPS

**URL:** https://discuss.elastic.co/t/send-monitoring-data-filebeat-to-https/230442
**Category:** Beats
**Tags:** filebeat
**Created:** [April 29, 2020, 9:23pm UTC](https://discuss.elastic.co/t/send-monitoring-data-filebeat-to-https/230442 "2020-04-29T21:23:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![v.n](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@v.n](https://discuss.elastic.co/u/v.n)
#### Post date: [April 29, 2020, 9:23pm UTC](https://discuss.elastic.co/t/send-monitoring-data-filebeat-to-https/230442/1 "2020-04-29T21:23:06Z")

</div>

Hi,  
I want to make more secure sending monitoring data from filebeat to ES. Earlier it was secured just by login/password which were sent by HTTP that was detected by our internal IDS. So I implemented NGINX on port 9201 and made such a config, section is below:

```auto
    #============================== Xpack Monitoring ===============================
    # filebeat can export internal metrics to a central Elasticsearch monitoring
    # cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
    # reporting is disabled by default.

    # Set to true to enable the monitoring reporter.
    monitoring.enabled: true

    # Sets the UUID of the Elasticsearch cluster under which monitoring data for this
    # Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
    # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
    #monitoring.cluster_uuid:
    monitoring.elasticsearch:
        cluster_uuid: j-xxxxxxxxxxxxxxxxxxxx
        hosts: ["https://test.test.local:9201"]
        username: beats_system
        password: xxxxxxxxxxxxxxxxxxxxx

    # Uncomment to send the metrics to Elasticsearch. Most settings from the
    # Elasticsearch output are accepted here as well.
    # Note that the settings should point to your Elasticsearch *monitoring* cluster.
    # Any setting that is not set is automatically inherited from the Elasticsearch
    # output configuration, so if you have the Elasticsearch output configured such
    # that it is pointing to your Elasticsearch monitoring cluster, you can simply
    # uncomment the following line.
    #monitoring.elasticsearch:

```

The problem is that filebeat starts and works but nothing is sent to ES. I haven't found any errors in filebeat and ES logs. Maybe something wrong with my config?

---

<div class="post-metadata">

### Author: ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 29, 2020, 9:45pm UTC](https://discuss.elastic.co/t/send-monitoring-data-filebeat-to-https/230442/2 "2020-04-29T21:45:38Z")

</div>

First of all, I would like to inform you it is not necessary to put in place Nginx to secure the cluster with TLS.  
You can enable it if you install a `basic` license and your cluster is on version 6.8 or 7.1+.  
You can find more about it [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html).

* * *

Regarding the monitoring data, if you're using a self signed certificate, it is possible you'll have to add:

```auto

monitoring.elasticsearch:
  cluster_uuid: j-xxxxxxxxxxxxxxxxxxxx
  hosts: ["https://test.test.local:9201"]
  username: beats_system
  password: xxxxxxxxxxxxxxxxxxxxx
  ssl.certificate_authorities: ["<ca pem file>"]
  ssl.verification_mode: full # set to none if the certificate doesn't contain the correct CN name

```

In case of doubts, start Filebeat with the parameters `-e -d '*'` to enable the debug logs

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2020, 9:45pm UTC](https://discuss.elastic.co/t/send-monitoring-data-filebeat-to-https/230442/3 "2020-05-27T21:45:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
