# Winlogbeat ssl to elasticsearch
**URL:** https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039
**Category:** Beats
**Tags:** elastic-stack-security, winlogbeat
**Created:** [December 8, 2020, 7:14pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039 "2020-12-08T19:14:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ChrisDaniels](https://discuss.elastic.co/u/ChrisDaniels)
#### Post date: [December 8, 2020, 7:14pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039/1 "2020-12-08T19:14:08Z")
Followed the encrypting communications between nodes in a cluster and elasticsearch is running but now elasticsearch is not accepting connections from winlogbeat. When I run winlogbeat.exe test config-c winlogbeat.yml I get the error "tls: private key does not match public key"
Running a cluster with 3 nodes all on ubuntu 18. What am I missing?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [December 9, 2020, 12:53am UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039/2 "2020-12-09T00:53:15Z")
We need to understand more about your configuration of Elasticsearch and winbeat in order to be able to help you.
It's almost impossible to diagnose a configuration problem when all we have to work with is a single error message.
---
### Author:  [@ChrisDaniels](https://discuss.elastic.co/u/ChrisDaniels)
#### Post date: [December 10, 2020, 12:59am UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039/3 "2020-12-10T00:59:48Z")
####################### Elasticsearch.yml ######################
cluster.name: NMHS-Cluster
node.name: elastic
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 10.14.0.237
http.port: 9200
discovery.seed\_hosts: ["10.14.0.237", "10.14.251.27", "10.14.254.155"]
cluster.initial\_master\_nodes: ["elastic", "elastic2", "elastic3"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification\_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /etc/elasticsearch/http.p12
###################### Winlogbeat Configuration ########################
winlogbeat.event\_logs:
- name: Application
ignore\_older: 72h
- name: System
- name: Security
processors:
- name: Microsoft-Windows-Sysmon/Operational
processors:
- name: Windows PowerShell
event\_id: 400, 403, 600, 800
processors:
- name: Microsoft-Windows-PowerShell/Operational
event\_id: 4103, 4104, 4105, 4106
processors:
- name: ForwardedEvents
tags: [forwarded]
processors:
====================== Elasticsearch template settings =======================
setup.template.settings:
index.number\_of\_shards: 1
#index.codec: best\_compression
#\_source.enabled: false
=================================== Kibana ===================================
Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
This requires a Kibana endpoint configuration.
setup.kibana:
host: "[elastic.nmhs.org:5601](http://elastic.nmhs.org:5601)"
================================== Outputs ===================================
#Configure what output to use when sending the data collected by the beat.
---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
hosts: ["[https://elastic.nmhs.org:9200](https://elastic.nmhs.org:9200)"]
#ssl.key\_passphrase: "Handiman1@3"
#ssl.certificate: 'c:\Program files\winlogbeat\elasticsearch-ca.pem'
#ssl.key: 'c:\Program files\winlogbeat\http-elastic.key'
protocol: "https"
Authentication credentials - either API key or username/password.
#api\_key: "id:api\_key"
username: "elastic"
password: "password"
Here are the configurations and the error I'm getting:
[2020-12-09T18:58:49,005][WARN][o.e.h.AbstractHttpServerTransport] [elastic] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/10.14.0.237:9200, remoteAddress=/10.14.255.186:56816}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2021, 12:59am UTC](https://discuss.elastic.co/t/winlogbeat-ssl-to-elasticsearch/258039/4 "2021-01-07T00:59:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.