# SSL certificate error for sending logs from Filebeat to Graylog using logstash output

**URL:** <https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 8, 2018, 5:36am UTC](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969 "2018-02-08T05:36:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Umesh\_Dc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umesh_dc/32/23310_2.png) [@Umesh\_Dc](https://discuss.elastic.co/u/Umesh_Dc)\
**Post date:** [February 8, 2018, 5:36am UTC](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969/1 "2018-02-08T05:36:02Z")

</div>

Hi,

Currently I am planning to use TLS certificate for sending logs using filebeat to Graylog.

I am using below command to generate server certificate and private key,  
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout logstash.key -out logstash.crt

Filebeat Configuration is as below,  
output.logstash:  
hosts: ["graylog-host:5046"]  
compression\_level: 9  
tls:  
certificate\_authorities: ["/tmp/tls-keys/graylog-server-tls.crt"]

Filebeat error is as below,

2018-02-07T14:41:37Z ERR Failed to publish events caused by: EOF  
2018-02-07T14:41:37Z INFO Error publishing events (retrying): EOF

Please help with how we can create self signed TLS certificate that will work for Graylog input.

Thanks in Advance

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 8, 2018, 11:51pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969/2 "2018-02-08T23:51:39Z")

</div>

Please format logs, configs and terminal input/output using the `</>`-Button or [markdown code fences](https://help.github.com/articles/creating-and-highlighting-code-blocks/#fenced-code-blocks). This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts.

Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs.

Which filebeat version are you using? I think it should say `ssl` not `tls` in your config.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2018, 12:00am UTC](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969/3 "2018-03-09T00:00:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.