# The logstash-keystore utility produces many, many errors

**URL:** <https://discuss.elastic.co/t/the-logstash-keystore-utility-produces-many-many-errors/157769>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [November 21, 2018, 7:06pm UTC](https://discuss.elastic.co/t/the-logstash-keystore-utility-produces-many-many-errors/157769 "2018-11-21T19:06:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbrowe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbrowe/32/99821_2.png) [@jbrowe](https://discuss.elastic.co/u/jbrowe)\
**Post date:** [November 21, 2018, 7:06pm UTC](https://discuss.elastic.co/t/the-logstash-keystore-utility-produces-many-many-errors/157769/1 "2018-11-21T19:06:24Z")

</div>

I'm working to secure all my Elastic communications channels and config files. I use the elastic and kibana keystore utilities to store all the passwords that are scattered throughout the config files. This now works and all my kibana and ES config files are rid of plaintext passwords and all communications are encrypted.

Now I'm moving to Logstash. I'm running ES v6.4 on all nodes using the CentOS 7 rpm repository version. As a first step, I want to set up the logstash keystore to keep all the passwords. I created the keystore password environmental config as follows:

```
vi /etc/sysconfig/logstash.
Add line.. LOGSTASH_KEYSTORE_PASS="mypassword"

chown root:root /etc/sysconfig/logstash
chmod 600 /etc/sysconfig/logstash

```

I assume the previous sysconfig setting is for the logstash service once it starts. I load the environment variable into my shell (not running as root):

```
set +o history    
export LOGSTASH_KEYSTORE_PASS="mypassword"
set -o history

```

Next I create the keystore in the /etc/logstash directory:

```
sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create

```

This generates the following output, which seems to have completed correctly but it created a strange directory that is related to the error messages, as shown below:

```
2018-11-21 10:44:57,996 main ERROR Unable to locate appender "${sys:ls.log.format}_console" for logger config "root"
2018-11-21 10:44:57,997 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
2018-11-21 10:44:57,998 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling_slowlog" for logger config "slowlog"
2018-11-21 10:44:57,998 main ERROR Unable to locate appender "${sys:ls.log.format}_console_slowlog" for logger config "slowlog"

Created Logstash keystore at /etc/logstash/logstash.keystore

ls-node-1$ ls -altr /etc/logstash
....
drwxr-xr-x. 2 root root 96 Nov 21 10:44 ${sys:ls.logs}
-rw-r--r--. 1 root root 383 Nov 21 10:45 logstash.keystore
....

```

I press on in spite of the errors. Next I add a password for the `xpack.monitoring.elasticsearch.password` entry:

```
sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash add MON_ES_PWD
2018-11-21 10:54:14,119 main ERROR Unable to locate appender "${sys:ls.log.format}_console" for logger config "root"
2018-11-21 10:54:14,120 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
2018-11-21 10:54:14,120 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling_slowlog" for logger config "slowlog"
2018-11-21 10:54:14,121 main ERROR Unable to locate appender "${sys:ls.log.format}_console_slowlog" for logger config "slowlog"

Enter value for MON_ES_PWD: 
Added 'mon_es_pwd' to the Logstash keystore.

```

Again, the errors, however, the entry seems to be in place.

```
sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash list
2018-11-21 11:01:30,100 main ERROR Unable to locate appender "${sys:ls.log.format}_console" for logger config "root"
2018-11-21 11:01:30,101 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"
2018-11-21 11:01:30,101 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling_slowlog" for logger config "slowlog"
2018-11-21 11:01:30,102 main ERROR Unable to locate appender "${sys:ls.log.format}_console_slowlog" for logger config "slowlog"

mon_es_pwd

```

I'm not confident that this is working correctly given the symptoms above. I hesitate to blindly enter the MON\_ES\_PWD variable in my logstash config and bring down my ingest pipeline in the process. Any advice?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2018, 7:13pm UTC](https://discuss.elastic.co/t/the-logstash-keystore-utility-produces-many-many-errors/157769/2 "2018-12-19T19:13:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.