# Winlogbeat to Logstash over SSL
**URL:** https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705
**Category:** Logstash
**Created:** [January 9, 2023, 7:44am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705 "2023-01-09T07:44:30Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 9, 2023, 7:44am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/1 "2023-01-09T07:44:30Z")
Good day,
Can someone assist me with a secure connection from my beats to my logstash instances.
Thanks.
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 9, 2023, 7:54am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/2 "2023-01-09T07:54:50Z")
Hello Mark, welcome to the hood 🙂
Have you tried following the Elastic documentation for the same: [Secure communication with Logstash | Winlogbeat Reference [8.5] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuring-ssl-logstash.html) ?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 9, 2023, 7:59am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/3 "2023-01-09T07:59:51Z")
Also you have older blog [here](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash)
---
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 10, 2023, 6:51am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/4 "2023-01-10T06:51:10Z")
Hi Gents,
Thanks for the response I tried both of these, still no luck. Runnning version 8.5.
For now I'm sending logs directly from my vpn connections to my elasticsearch instances. But this is not recommended for me as we do have external clients coming up.
---
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 10, 2023, 7:27am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/5 "2023-01-10T07:27:41Z")
My problem comes in with the creation of the beats to logstash. Logstash to elasticsearch I'm using the .pem file. There is not alot of information regarding the process of creating the correct certs and format for the beats to logstash.
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 10, 2023, 1:54pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/6 "2023-01-10T13:54:25Z")
@Mark_Marais Its hard to say anything without looking at the configurations, manifests and logs, can you please share them for better understanding what exactly you're trying out ?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 10, 2023, 2:11pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/7 "2023-01-10T14:11:47Z")
You need pcks8 format in input conf
`openssl pkcs8 -in config/certs/logstash.key -topk8 -nocrypt -out config/certs/logstash.pkcs8.key`
```auto
input {
beats {
port => 5044
ssl => true
ssl_key => '/etc/logstash/config/certs/logstash.pkcs8.key'
ssl_certificate => '/etc/logstash/config/certs/logstash.crt'
}
}
```
---
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 11, 2023, 12:01pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/8 "2023-01-11T12:01:24Z")
Thanks Rios. I tried converting it but seems to reject my communication still.
Image uploaded is the current winlogbeat sending directly to my elasticsearch instances, using the elasticsearch-ca.pem certificate.
This will be one of my elasticsearch.yml config files.
And this will be my config for logstash that is not working at the moment you will see I commented out the ssl part for input.
What I'm trying to achieve is pushing my winlogbeats events through to my logstash nodes - using ofcourse a DNS name that is linked to my public ip. My main concern is how and which certs should i use for the communication from beats to logstash and then logstash to elasticsearch. Another thing is I don't want the logstash events to corrupt any of my current index or indicies that is currently working.
Thanks once again for your time guys.
---
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 16, 2023, 8:17am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/9 "2023-01-16T08:17:48Z")
No response... sigh please guys
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 16, 2023, 9:18am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/10 "2023-01-16T09:18:23Z")
Try with:
```auto
output.elasticsearch:
ssl:
enabled: true
client_authentication: required
certificate_authorities: [path/to/ca/certificate]
```
---
### Author:  [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)
#### Post date: [January 16, 2023, 9:31am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/11 "2023-01-16T09:31:05Z")
> [@Ayush\_Mathur](#):
>
> `certificate_authorities`
The issue is not with the output to elasticsearch. The problem is what certificates should i use for beats to logstash. Can i use the cergen tool?
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 16, 2023, 1:56pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/12 "2023-01-16T13:56:11Z")
You can use `elasticsearch-certutil` which is bundled along with elasticsearch and is available in /bin folder. You can either generate P12 certificates and use them or use SAN based ca/instance/key certificates. Documentation is available here: [elasticsearch-certutil | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 13, 2023, 1:56pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705/13 "2023-02-13T13:56:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.