# Very very new to this

**URL:** <https://discuss.elastic.co/t/very-very-new-to-this/280248>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [August 2, 2021, 6:14pm UTC](https://discuss.elastic.co/t/very-very-new-to-this/280248 "2021-08-02T18:14:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinceisvince](https://avatars.discourse-cdn.com/v4/letter/v/7bcc69/32.png) [@vinceisvince](https://discuss.elastic.co/u/vinceisvince)\
**Post date:** [August 2, 2021, 6:14pm UTC](https://discuss.elastic.co/t/very-very-new-to-this/280248/1 "2021-08-02T18:14:18Z")

</div>

I'll do a high level overview. We are using IBM's APIC v10. It uses Kubernetes which I'm all but a few days new to it. They seemt o have used logstash on top of that for their propriety "analytics server".

I feel like IBM is getting stumped here surprisingly so worse case we'll just fall back on them but I would love to figure this out on my own so I'm learning a lot already.

Anyhow we are offloading to SPLUNK. We are using the HTTP output plugin

> **[Http output plugin | Logstash Reference \[7.13\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html#plugins-outputs-http-truststore)**

SPLUNK is on HTTPS but has no cert requirements...

We were getting this error:  
:message=\>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :class=\>"Manticore::ClientProtocolException",

IBM surprisingly stated it's coming from SPLUNK to which we had to go through that pain to prove not. They haven't come back yet since...

In looking over things, I setup a "secret" and loaded to kubernetes  
[https://www.ibm.com/docs/en/api-connect/10.0.1.x?topic=system-providing-custom-certificate-analytics-offload](https://www.ibm.com/docs/en/api-connect/10.0.1.x?topic=system-providing-custom-certificate-analytics-offload)

Referenced that secret in my config which still had the same error. I added the truststore field:

spec:  
external:  
offload:  
enabled: true  
secretName: offload-certificates  
output: |  
http {  
url =\> "https://\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"  
http\_method =\> "post"  
codec =\> "json"  
content\_type =\> "application/json"  
id =\> "offload\_http"  
headers =\> ["Authorization", "Splunk \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"]  
truststore =\> "/etc/velox/analytics-ingestion.jks"  
}  
~

which now gives  
:message=\>"undefined method `value' for nil:NilClass", :class=\>"NoMethodError",

Shooting in the dark here but I'm guessing I can't use the truststore like that. Basically playing around with this. Honestly I thought it would have just worked but I guess it's not using some default TLS here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2021, 6:14pm UTC](https://discuss.elastic.co/t/very-very-new-to-this/280248/2 "2021-08-30T18:14:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.