# Unable to send Data from Metricbeat to Elasticsearch over SSL getting error Failed to connect to backoff(elasticsearch(https://xxx.xx.xxx.xx:9202)): Get https://xxx.xx.xxx.xx:9202: Forbidden

**URL:** <https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-elasticsearch-over-ssl-getting-error-failed-to-connect-to-backoff-elasticsearch-https-xxx-xx-xxx-xx-9202-get-https-xxx-xx-xxx-xx-forbidden/177242>\
**Category:** Elasticsearch\
**Created:** [April 17, 2019, 8:59am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-elasticsearch-over-ssl-getting-error-failed-to-connect-to-backoff-elasticsearch-https-xxx-xx-xxx-xx-9202-get-https-xxx-xx-xxx-xx-forbidden/177242 "2019-04-17T08:59:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vsalunkhe](https://avatars.discourse-cdn.com/v4/letter/v/eada6e/32.png) [@vsalunkhe](https://discuss.elastic.co/u/vsalunkhe)\
**Post date:** [April 17, 2019, 8:59am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-elasticsearch-over-ssl-getting-error-failed-to-connect-to-backoff-elasticsearch-https-xxx-xx-xxx-xx-9202-get-https-xxx-xx-xxx-xx-forbidden/177242/1 "2019-04-17T08:59:47Z")

</div>

Hi,

I am unable to send the data from metricbeat to elasticsearch over SSL.  
My setup is:  
Elasticsearch 6.4.2  
Metricbeat 6.6.1

I have done the following steps:

1. Install Elasticsearch

2. Create CA and Certificates  
Create the CA as follows  
bin/elasticsearch-certutil ca --pem

3. In elasticsearch.yml  
path.data: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/data  
path.logs: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/logs  
network.host: xxx.xx.xxx.xx  
http.port: 9202  
#----------------------------------- X-Pack ------------------------------------  
xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.key: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/config/certs/instance/instance.key  
xpack.security.transport.ssl.certificate: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/config/certs/instance/instance.crt  
xpack.security.transport.ssl.certificate\_authorities: ["/mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/config/certs/ca/ca.crt"]

xpack.security.http.ssl.enabled: true  
xpack.security.http.ssl.verification\_mode: certificate  
xpack.security.http.ssl.key: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/config/certs/instance/instance.key  
xpack.security.http.ssl.certificate: /mnt/appln/elkuser/withoutdns/elasticsearch-6.4.2/config/certs/instance/instance.crt

Started the elasticsearch

1. metricbeat.yml

output.elasticsearch:  
hosts: ["xxx.xx.xx.xx:9202"]  
protocol: "https"  
username: "elastic"  
password: "verysecret"  
ssl.certificate\_authorities: ["/mnt/appln/elkuser/withoutdns/metricbeat-6.6.1-linux-x86\_64/certs/ca/ca.pem"]  
ssl.certificate: "/mnt/appln/elkuser/withoutdns/metricbeat-6.6.1-linux-x86\_64/certs/instance/instance.pem"  
ssl.key: "/mnt/appln/elkuser/withoutdns/metricbeat-6.6.1-linux-x86\_64/certs/instance/instance.key"

and then started the metricbeat using  
./metricbeat -e

But I am unable to send the metric data to elasticsearch and getting the error as  
**"Failed to connect to backoff(elasticsearch([https://xxx.xx.xxx.xx:9202](https://xxx.xx.xxx.xx:9202))): Get [https://xxx.xx.xxx.xx:9202](https://xxx.xx.xxx.xx:9202): Forbidden"**  
The certificates I have created are all without dns name and so I am using IP in metricbeat.yml

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 18, 2019, 1:34am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-elasticsearch-over-ssl-getting-error-failed-to-connect-to-backoff-elasticsearch-https-xxx-xx-xxx-xx-9202-get-https-xxx-xx-xxx-xx-forbidden/177242/2 "2019-04-18T01:34:52Z")

</div>

By default Elasticsearch will only listen to localhost. You may want to add a `network.host` config option to make it listen to other addresses.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2019, 1:34am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-metricbeat-to-elasticsearch-over-ssl-getting-error-failed-to-connect-to-backoff-elasticsearch-https-xxx-xx-xxx-xx-9202-get-https-xxx-xx-xxx-xx-forbidden/177242/3 "2019-05-16T01:34:53Z")

</div>

Closed on May 16, 2019, 1:34am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.