# Unable to handshake Logstash and Elastic after TLS encryption **URL:** \ **Category:** Logstash\ **Created:** [July 10, 2021, 8:46am UTC](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319 "2021-07-10T08:46:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Debarati\_Goswami](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debarati_goswami/32/86043_2.png) [@Debarati\_Goswami](https://discuss.elastic.co/u/Debarati_Goswami)\ **Post date:** [July 10, 2021, 8:46am UTC](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319/1 "2021-07-10T08:46:47Z")
Hi All , This is the first time I am building up an ELK stack for my customer . After enabling minimal , basic and basic+HTTPs security for Elastic Stack , I am unable to run pipelines due to certification related issues . I tried all the steps and even solved blog methods but still in a soup ☹ . Need urgent help to solve this . Any help will be really appreciated . Getting the following error :: \ "bld20690004" port =\> 61002 type =\> "syslog" } } filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] target =\> "syslog\_timestamp" } } } output{ elasticsearch{ hosts =\> ["[https://bld20690001:61000](https://bld20690001:61000)"] ssl =\> true cacert =\> "/etc/logstash/config/certs/elastic-certificates-ca\_1.pem" user =\> "elastic" password =\> "security9" #index =\> "syslog-received-on-tcp" #index =\> "logstashtest-%{+YYYY.MM.dd}" } stdout { codec =\> "rubydebug" } } Logstash.yml --\> # X-Pack Monitoring # [Monitoring Logstash with APIs | Logstash](https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html) xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.username: logstash\_system xpack.monitoring.elasticsearch.password: xxxxxxxx #xpack.monitoring.elasticsearch.proxy: ["[http://proxy](http://proxy):port"] xpack.monitoring.elasticsearch.hosts: ["[https://bld20690001:61000](https://bld20690001:61000)"] # an alternative to hosts + username/password settings is to use cloud\_id/cloud\_auth #xpack.monitoring.elasticsearch.cloud\_id: monitoring\_cluster\_id:xxxxxxxxxx #xpack.monitoring.elasticsearch.cloud\_auth: logstash\_system:password # another authentication alternative is to use an Elasticsearch API key #xpack.monitoring.elasticsearch.api\_key: "id:api\_key" xpack.monitoring.elasticsearch.ssl.certificate\_authority: /etc/logstash/config/certs/elastic-certificates-ca\_1.pem #xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file #xpack.monitoring.elasticsearch.ssl.truststore.password: password #xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file #xpack.monitoring.elasticsearch.ssl.keystore.password: password #xpack.monitoring.elasticsearch.ssl.verification\_mode: certificate #xpack.monitoring.elasticsearch.sniffing: false #xpack.monitoring.collection.interval: 10s #xpack.monitoring.collection.pipeline.details.enabled: true Also note I have tried to created pem files from following :: 1. Tried with pem file created from elastic-certificates.p12 generated from Basic security 2. Tried with pem file created from http.12 (from basic+https step) :: elasticsearch-ca.pem 3. Tried with pem file created from (./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --ip 10.50.139.2,10.50.139.3,10.50.139.4,10.50.139.5,10.50.139.6,10.50.139.8,10.50.139.9 --dns bld20690001,bld20690002,bld20690003,bld20690004,bld20690005,bld20690007,bld20690008) :: elastic-certificates-ca\_1.pem None worked . I may be missing some integral part . PFB detailed log file :: Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [INFO] 2021-07-10 09:24:47.390 [main] runner - Starting Logstash {"logstash.version"=\>"7.13.2", "jruby.version"=\>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86\_64]"} [WARN] 2021-07-10 09:24:47.595 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2021-07-10 09:24:48.091 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} [INFO] 2021-07-10 09:24:48.740 [Converge PipelineAction::Create] Reflections - Reflections took 29 ms to scan 1 urls, producing 24 keys and 48 values [WARN] 2021-07-10 09:24:49.565 [Converge PipelineAction::Create] elasticsearch - Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode. [INFO] 2021-07-10 09:24:49.731 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[https://bld20690001:61000](https://bld20690001:61000)"]} [INFO] 2021-07-10 09:24:49.988 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[https://elastic:xxxxxx@bld20690001:61000/](https://elastic:xxxxxx@bld20690001:61000/)]}} [ERROR] 2021-07-10 09:24:50.220 [[main]-pipeline-manager] javapipeline - Pipeline error {:pipeline\_id=\>"main", :exception=\>#\, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/manticore\_adapter.rb:74:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:306:in `perform\_request\_to\_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:258:in `health_check_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:265:in `block in healthcheck!'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:263:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:354:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:86:in `update\_initial\_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:80:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:340:in `build\_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client.rb:62:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:106:in `create\_http\_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http\_client\_builder.rb:102:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:34:in `build\_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch.rb:275:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register\_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in `register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:585:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in `start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"], "pipeline.sources"=\>["/etc/logstash/conf.d/logstash\_syslog\_test.conf"], :thread=\>"#\"} [INFO] 2021-07-10 09:24:50.222 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=\>"main"} [ERROR] 2021-07-10 09:24:50.237 [Converge PipelineAction::Create] agent - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil} [INFO] 2021-07-10 09:24:50.300 [LogStash::Runner] runner - Logstash shut down. ---
**Author:** ![Debarati\_Goswami](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/debarati_goswami/32/86043_2.png) [@Debarati\_Goswami](https://discuss.elastic.co/u/Debarati_Goswami)\ **Post date:** [July 12, 2021, 9:37am UTC](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319/2 "2021-07-12T09:37:05Z")
Any luck anyone ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2021, 9:37am UTC](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319/3 "2021-08-09T09:37:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.