# TLS not being used between Winlogbeat and Logstash - No errors

**URL:** https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630
**Category:** Beats
**Tags:** winlogbeat
**Created:** [September 15, 2016, 4:06pm UTC](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630 "2016-09-15T16:06:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![gamaier](https://avatars.discourse-cdn.com/v4/letter/g/eb8c5e/32.png) [@gamaier](https://discuss.elastic.co/u/gamaier)
#### Post date: [September 15, 2016, 4:06pm UTC](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630/1 "2016-09-15T16:06:25Z")

</div>

So I'm wondering if anyone has run into this issue before.  
I've created a self signed cert on my elastic/logstash box and deployed this to a dev box as well. After thinking this was working since I get no errors regarding the certificates I went to watch the traffic with wireshark to confirm and it just shows TCP traffic and no TLS traffic between the two machines.

My configuration is fairly basic:  
Beats Input:  
input {  
beats {  
port =\> 5045  
ssl =\> true  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

Winlogbeat output:

output:  
logstash:

```
hosts: ["elastic01.***[omitted]****.com:5045"]
tls:
  certificate_authorities: ["C:/ProgramData/winlogbeat/logstash-forwarder.crt"]

```

If anyone has any thoughts I'd be very curious. I don't even see an SSL handshake take place or errors anywhere in any log.

Thank you!

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [September 16, 2016, 12:58pm UTC](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630/2 "2016-09-16T12:58:18Z")

</div>

logstash requires you to use SSL, otherwise it would close the connection on first send attempt.

Have you tried to decode the packets as TLS in wireshark? Then you might see the handshake. By default wireshark will display TCP, because TLS/SSL runs on top of TCP.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 7, 2016, 12:59pm UTC](https://discuss.elastic.co/t/tls-not-being-used-between-winlogbeat-and-logstash-no-errors/60630/3 "2016-10-07T12:59:02Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.
