# Winlogbeats not working with SSL configuration to Logstash **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [April 3, 2018, 5:12am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502 "2018-04-03T05:12:42Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 5:12am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/1 "2018-04-03T05:12:42Z")
Hi, I need some assistance with my Winlogbeats SSL configuration. My winlogbeats machine sending logs yml config: ```auto winlogbeat.event_logs: - name: Application ignore_older: 72h - name: Security - name: System setup.template.settings: fields: client: clientName setup.kibana: output.logstash: # The Logstash hosts hosts: ["192.168.100.244:5044"] ssl.certificate_authorities: ["c:/programdata/winlogbeat/ca.crt"] ssl.certificate: "c:/programdata/winlogbeat/client.crt" ssl.key: "c:/programdata/winlogbeat/client.key" logging.level: info logging.level: debug logging.level: error logging.level: warning logging.selectors: ["*"] ``` My Logstash server: ```auto input { beats { port => 5044 type => "logs" ssl => true ssl_certificate => "C:/temp/WinlogBeatsSSL/client.crt" ssl_key => "C:/temp/WinlogBeatsSSL/client.key" } } output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` I am not getting any logs once I enable SSL, but once disabled, it works fine. Please advise what I am doing wrong. thanks, Pat ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 1:55pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/2 "2018-04-03T13:55:05Z")
What does the command tell you? ```auto PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test output -e -d "*" ``` ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 2:40pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/3 "2018-04-03T14:40:56Z")
> [@andrewkroh](#): > > .\winlogbeat.exe test output -e -d "\*" ```auto H:\WinlogBeats>.\winlogbeat.exe test output -e -d "*" 2018-04-03T07:36:18.424-0700 INFO instance/beat.go:468 Home path: [H:\W inlogBeats] Config path: [H:\WinlogBeats] Data path: [H:\WinlogBeats\data] Logs path: [H:\WinlogBeats\logs] 2018-04-03T07:36:18.430-0700 DEBUG [beat] instance/beat.go:495 Beat met adata path: H:\WinlogBeats\data\meta.json 2018-04-03T07:36:18.434-0700 INFO instance/beat.go:475 Beat UUID: 4afcb bd1-4864-42d1-ad55-1e9939740496 Error initializing output: missing required field accessing 'output.logstash.hos ts' ``` ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 2:42pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/4 "2018-04-03T14:42:44Z")
Just a little pre-note, this works just fine if I do not have ssl enabled, but we do not want that. I think I may not have my certs in order. I will try and re-create some and redeploy and let you know. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 3:00pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/5 "2018-04-03T15:00:22Z")
> [@patricktula](#): > > Error initializing output: missing required field accessing 'output.logstash.hos > [@patricktula](#): > > ```auto > output.logstash: > # The Logstash hosts > hosts: ["192.168.100.244:5044"] > ssl.certificate_authorities: ["c:/programdata/winlogbeat/ca.crt"] > ssl.certificate: "c:/programdata/winlogbeat/client.crt" > ssl.key: "c:/programdata/winlogbeat/client.key" > > ``` The indentation is wrong in your configuration. It should look like: ```auto output.logstash: # The Logstash hosts hosts: ["192.168.100.244:5044"] ssl.certificate_authorities: ["c:/programdata/winlogbeat/ca.crt"] ssl.certificate: "c:/programdata/winlogbeat/client.crt" ssl.key: "c:/programdata/winlogbeat/client.key" ``` ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 6:35pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/6 "2018-04-03T18:35:37Z")
> [@andrewkroh](#): > > output.logstash: > > # The Logstash hosts > > hosts: ["192.168.100.244:5044"] > ssl.certificate\_authorities: ["c:/programdata/winlogbeat/ca.crt"] > ssl.certificate: "c:/programdata/winlogbeat/client.crt" > ssl.key: "c:/programdata/winlogbeat/client.key" Thanks Andrew. I updated it, and now getting this error below H:\WinlogBeats\>.\winlogbeat.exe -c winlogbeat.yml -e -d "\*" -configtest Flag --configtest has been deprecated, configtest flag has been deprecated, use test config subcommand 2018-04-03T11:30:25.901-0700 INFO instance/beat.go:468 Home path: [H:\W inlogBeats] Config path: [H:\WinlogBeats] Data path: [H:\WinlogBeats\data] Logs path: [H:\WinlogBeats\logs] 2018-04-03T11:30:25.903-0700 DEBUG [beat] instance/beat.go:495 Beat met adata path: H:\WinlogBeats\data\meta.json 2018-04-03T11:30:25.904-0700 INFO instance/beat.go:475 Beat UUID: 4afcb bd1-4864-42d1-ad55-1e9939740496 2018-04-03T11:30:25.905-0700 INFO instance/beat.go:213 Setup Beat: winl ogbeat; Version: 6.2.3 2018-04-03T11:30:25.909-0700 WARN instance/metrics\_other.go:8 Metrics not implemented for this OS. 2018-04-03T11:30:25.911-0700 DEBUG [beat] instance/beat.go:230 Initiali zing output plugins 2018-04-03T11:30:25.912-0700 DEBUG [processors] processors/processor.go: 49 Processors: 2018-04-03T11:30:25.914-0700 ERROR outputs/tls.go:229 Dropping encrypt ed pem 'RSA PRIVATE KEY' block read from c:/programdata/winlogbeat/client.key. N o passphrase available 2018-04-03T11:30:25.917-0700 ERROR outputs/tls.go:184 Failed reading k ey file c:/programdata/winlogbeat/client.key: no PEM blocks 2018-04-03T11:30:25.920-0700 ERROR instance/beat.go:667 Exiting: error i nitializing publisher: 1 error: no PEM blocks c:/programdata/winlogbeat/client.k ey Exiting: error initializing publisher: 1 error: no PEM blocks c:/programdata/win logbeat/client.key ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 7:04pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/7 "2018-04-03T19:04:42Z")
> [@patricktula](#): > > 2018-04-03T11:30:25.914-0700 ERROR outputs/tls.go:229 Dropping encrypted pem 'RSA PRIVATE KEY' block read from c:/programdata/winlogbeat/client.key. No passphrase available The client certificate that you have configured Winlogbeat to use to authenticate to Logstash appears to be encrypted. Winlogbeat must be configured with the decryption password in order to use this client certificate. Use [ssl.key\_passphrase](https://www.elastic.co/guide/en/beats/winlogbeat/6.2/configuration-ssl.html#_literal_key_passphrase_literal) for this. ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 7:27pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/8 "2018-04-03T19:27:28Z")
> [@andrewkroh](#): > > ssl.key\_passphrase That got the service started up! I checked again and do not see any more errors, but still yet to see logs on Kibana as I was seeing before I enabled SSL. ```auto H:\WinlogBeats>.\winlogbeat.exe -c winlogbeat.yml -e -d "*" -configtest Flag --configtest has been deprecated, configtest flag has been deprecated, use test config subcommand 2018-04-03T12:20:07.186-0700 INFO instance/beat.go:468 Home path: [H:\W inlogBeats] Config path: [H:\WinlogBeats] Data path: [H:\WinlogBeats\data] Logs path: [H:\WinlogBeats\logs] 2018-04-03T12:20:07.191-0700 DEBUG [beat] instance/beat.go:495 Beat met adata path: H:\WinlogBeats\data\meta.json 2018-04-03T12:20:07.195-0700 INFO instance/beat.go:475 Beat UUID: 4afcb bd1-4864-42d1-ad55-1e9939740496 2018-04-03T12:20:07.198-0700 INFO instance/beat.go:213 Setup Beat: winl ogbeat; Version: 6.2.3 2018-04-03T12:20:07.201-0700 WARN instance/metrics_other.go:8 Metrics not implemented for this OS. 2018-04-03T12:20:07.204-0700 DEBUG [beat] instance/beat.go:230 Initiali zing output plugins 2018-04-03T12:20:07.207-0700 DEBUG [processors] processors/processor.go: 49 Processors: 2018-04-03T12:20:07.216-0700 INFO pipeline/module.go:76 Beat name: SQLPR ODUCTION 2018-04-03T12:20:07.218-0700 INFO beater/winlogbeat.go:56 State will be re ad from and persisted to H:\WinlogBeats\data\.winlogbeat.yml 2018-04-03T12:20:07.221-0700 DEBUG [eventlog] eventlog/factory.go:129 Using highest priority API, wineventlog, for event log Application 2018-04-03T12:20:07.226-0700 DEBUG [winlogbeat] beater/winlogbeat.go:83 Initialized EventLog[Application] 2018-04-03T12:20:07.229-0700 DEBUG [processors] processors/processor.go: 49 Processors: 2018-04-03T12:20:07.232-0700 DEBUG [eventlog] eventlog/factory.go:129 Using highest priority API, wineventlog, for event log Security 2018-04-03T12:20:07.236-0700 DEBUG [winlogbeat] beater/winlogbeat.go:83 Initialized EventLog[Security] 2018-04-03T12:20:07.239-0700 DEBUG [processors] processors/processor.go: 49 Processors: 2018-04-03T12:20:07.241-0700 DEBUG [eventlog] eventlog/factory.go:129 Using highest priority API, wineventlog, for event log System 2018-04-03T12:20:07.245-0700 DEBUG [winlogbeat] beater/winlogbeat.go:83 Initialized EventLog[System] 2018-04-03T12:20:07.248-0700 DEBUG [processors] processors/processor.go: 49 Processors: 2018-04-03T12:20:07.251-0700 WARN [cfgwarn] instance/beat.go:283 DEPRECATED: -configtest flag has been deprecated, use configtest subcommand Will be removed in version: 6.0 Config OK 2018-04-03T12:20:07.251-0700 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s 2018-04-03T12:20:07.260-0700 INFO [monitoring] log/log.go:132 Total no n-zero metrics {"monitoring": {"metrics": {"libbeat":{"config":{"module":{"runn ing":0}},"output":{"type":"logstash"},"pipeline":{"clients":0,"events":{"active" :0}}},"uptime":"{\"server_time\":\"2018-04-03T19:20:07.2608827Z\",\"start_time\" :\"2018-04-03T19:20:07.1688735Z\",\"uptime\":\"92.0092ms\",\"uptime_ms\":\"92009 \"}"}}} 2018-04-03T12:20:07.269-0700 INFO [monitoring] log/log.go:133 Uptime: 155.6081ms 2018-04-03T12:20:07.272-0700 INFO [monitoring] log/log.go:110 Stopping metrics logging. ``` Kibana logs stuck on April 2, 2018 - image below ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b96df60047fb9cc7588b5a432f5774a94d330d56.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 7:52pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/9 "2018-04-03T19:52:59Z")
Have you started the Beat since then (without `-configtest`)? Run Winlogbeat for a few minutes and post the logs. If you want it to resend all data you can delete the registry file at `C:\ProgramData\winlogbeat\.winlogbea.tyml` before starting Winlogbeat Your Logstash config doesn't match up with the recommendations in the Beats documentation. See [Setup Logstash](https://www.elastic.co/guide/en/beats/libbeat/6.2/logstash-installation.html#logstash-setup). And you must [load the index template into Elasticsearch manually](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually) because the options for auto loading the template are only available for the Elasticsearch output. And setting `type => "logs"` doesn't do anything because the value is already set by Winlogbeat. See [type](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-type) in the Logstash beats input docs for the details. ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 9:12pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/10 "2018-04-03T21:12:50Z")
Ran without -configtest and it looks like showing all the event logs. 2018-04-03T14:03:53.584-0700 DEBUG [winlogbeat] beater/eventlogger.go:11 6 EventLog[Application] Read() returned 0 records 2018-04-03T14:03:54.588-0700 DEBUG [eventlog\_detail] eventlog/wineven tlog.go:180 WinEventLog[Application] No more events 2018-04-03T14:03:54.588-0700 DEBUG [winlogbeat] beater/eventlogger.go:11 6 EventLog[Application] Read() returned 0 records 2018-04-03T14:03:55.591-0700 DEBUG [eventlog\_detail] eventlog/wineven tlog.go:180 WinEventLog[Application] No more events 2018-04-03T14:03:55.591-0700 DEBUG [winlogbeat] beater/eventlogger.go:11 6 EventLog[Application] Read() returned 0 records 2018-04-03T14:03:56.594-0700 DEBUG [eventlog\_detail] eventlog/wineven tlog.go:180 WinEventLog[Application] No more events 2018-04-03T14:03:56.594-0700 DEBUG [winlogbeat] beater/eventlogger.go:11 6 EventLog[Application] Read() returned 0 records 2018-04-03T14:03:57.598-0700 DEBUG [eventlog\_detail] eventlog/wineven tlog.go:180 WinEventLog[Application] No more events 2018-04-03T14:03:57.598-0700 DEBUG [winlogbeat] beater/eventlogger.go:11 6 EventLog[Application] Read() returned 0 records 2018-04-03T14:03:57.770-0700 DEBUG [service] service/service.go:33 Received sigterm/sigint, stopping 2018-04-03T14:03:57.770-0700 INFO beater/winlogbeat.go:152 Stopping Winlogbeat 2018-04-03T14:03:57.770-0700 DEBUG [service] service/service.go:39 Received svc stop/shutdown request 2018-04-03T14:03:57.770-0700 INFO beater/eventlogger.go:92 EventLog [System] Stop processing. 2018-04-03T14:03:57.771-0700 DEBUG [eventlog] eventlog/wineventlog.go: 166 WinEventLog[System] Closing handle 2018-04-03T14:03:57.771-0700 INFO beater/eventlogger.go:92 EventLog [Security] Stop processing. 2018-04-03T14:03:57.771-0700 DEBUG [eventlog] eventlog/wineventlog.go: 166 WinEventLog[Security] Closing handle 2018-04-03T14:03:58.602-0700 INFO beater/eventlogger.go:92 EventLog [Application] Stop processing. 2018-04-03T14:03:58.602-0700 DEBUG [eventlog] eventlog/wineventlog.go: 166 WinEventLog[Application] Closing handle 2018-04-03T14:03:58.602-0700 INFO instance/beat.go:308 winlogbeat stopp ed. 2018-04-03T14:03:58.602-0700 INFO [monitoring] log/log.go:132 Total no n-zero metrics {"monitoring": {"metrics": {"libbeat":{"config":{"module":{"runn ing":0}},"output":{"read":{"errors":2},"type":"logstash","write":{"bytes":276}}, "pipeline":{"clients":0,"events":{"active":4116,"failed":147,"published":4116,"r etry":2705,"total":4263}}},"msg\_file\_cache":{"ApplicationHits":154,"ApplicationM isses":10,"SecurityHits":1899,"SecurityMisses":1,"SystemHits":2166,"SystemMisses ":34},"uptime":"{"server\_time":"2018-04-03T21:03:58.6025239Z","start\_time" :"2018-04-03T21:01:14.082329Z","uptime":"2m44.5201949s","uptime\_ms":"16 4520194"}"}}} 2018-04-03T14:03:58.603-0700 INFO [monitoring] log/log.go:133 Uptime: 2m44.5430028s From c:\winlogbeat\programdata\logs\winlogbeat | 2018-04-03T14:01:13.563-0700 | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.100.244:5044: connectex: No connection could be made because the target machine actively refused it. | | --- | --- | --- | --- | | 2018-04-03T14:01:22.544-0700 | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.100.244:5044: connectex: No connection could be made because the target machine actively refused it. | | 2018-04-03T14:01:39.548-0700 | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.100.244:5044: connectex: No connection could be made because the target machine actively refused it. | | 2018-04-03T14:02:12.549-0700 | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.100.244:5044: connectex: No connection could be made because the target machine actively refused it. | | 2018-04-03T14:03:13.582-0700 | ERROR | pipeline/output.go:74 | Failed to connect: dial tcp 192.168.100.244:5044: connectex: No connection could be made because the target machine actively refused it. | | 2018-04-03T14:04:13.603-0700 | ERROR | pipeline/output.go:74 | Failed to connect: read tcp 192.168.100.213:55488-\>192.168.100.244:5044: wsarecv: An existing connection was forcibly closed by the remote host. | | 2018-04-03T14:05:13.591-0700 | ERROR | pipeline/output.go:74 | Failed to connect: read tcp 192.168.100.213:55549-\>192.168.100.244:5044: wsarecv: An existing connection was forcibly closed by the remote host. | I have updated logstash setup to now look like this input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "C:/temp/WinlogBeatsSSL/Certificates/server.crt" ssl\_key =\> "C:/temp/WinlogBeatsSSL/Keys/server.key" } } output { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } And have loaded the template manually on the Winlogbeats computer to the elasticsearch server ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/72d57f755a73e184be2001a307b58eff5a5725bd.png) Still no logs. Stuck at the same time and date ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08eb1be171fb8af76ba7f88ed6d62f448ec25466.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 9:34pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/11 "2018-04-03T21:34:34Z")
I don't think you have shared the output from this yet: > [@Winlogbeats not working with SSL configuration to Logstash](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/2): > > What does the command tell you? PS C:\Program Files\Winlogbeat\> .\winlogbeat.exe test output -e -d "\*" ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 9:47pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/12 "2018-04-03T21:47:28Z")
> [@andrewkroh](#): > > .\winlogbeat.exe test output -e -d "\*" here you go: H:\WinlogBeats\> .\winlogbeat.exe test output -e -d "\*" 2018-04-03T14:42:54.318-0700 INFO instance/beat.go:468 Home path: [H:\W inlogBeats] Config path: [H:\WinlogBeats] Data path: [H:\WinlogBeats\data] Logs path: [H:\WinlogBeats\logs] 2018-04-03T14:42:54.324-0700 DEBUG [beat] instance/beat.go:495 Beat met adata path: H:\WinlogBeats\data\meta.json 2018-04-03T14:42:54.328-0700 INFO instance/beat.go:475 Beat UUID: 4afcb bd1-4864-42d1-ad55-1e9939740496 logstash: 192.168.100.244:5044... connection... parse host... OK dns lookup... OK addresses: 192.168.100.244 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... ERROR write tcp 192.168.100.213:57847-\>192.168.100.244:5044: ws asend: An existing connection was forcibly closed by the remote host. ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 9:48pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/13 "2018-04-03T21:48:17Z")
Logstash config: input { beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> ["C:/temp/WinlogBeatsSSL/Certificates/RootCA.crt"] ssl\_certificate =\> "C:/temp/WinlogBeatsSSL/Certificates/server.crt" ssl\_key =\> "C:/temp/WinlogBeatsSSL/Keys/server.key" ssl\_verify\_mode =\> "force\_peer" } } output { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 3, 2018, 10:04pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/14 "2018-04-03T22:04:11Z")
The above Logstash config looks good. Is this what was running when you ran the `winlogbeat test output` command? It seems like Logstash is rejecting the client certificate. Though I think to confirm that you will need to look at the logs on the server side (Logstash). Is the client certificate signed by what's in `C:/temp/WinlogBeatsSSL/Certificates/RootCA.crt`? Are there any details in the Logstash log output? ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 3, 2018, 11:08pm UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/15 "2018-04-03T23:08:42Z")
Ok had to re-create my certs again because was seeing 'bad key' on logstash errors, and got no more errors running _.\winlogbeat.exe test output -e -d "\*"_ H:\WinlogBeats\> .\winlogbeat.exe test output -e -d "\*" 2018-04-03T16:00:34.805-0700 INFO instance/beat.go:468 Home path: [H:\W inlogBeats] Config path: [H:\WinlogBeats] Data path: [H:\WinlogBeats\data] Logs path: [H:\WinlogBeats\logs] 2018-04-03T16:00:34.810-0700 DEBUG [beat] instance/beat.go:495 Beat met adata path: H:\WinlogBeats\data\meta.json 2018-04-03T16:00:34.813-0700 INFO instance/beat.go:475 Beat UUID: 4afcb bd1-4864-42d1-ad55-1e9939740496 logstash: corputility001w:5044... connection... parse host... OK dns lookup... OK addresses: 192.168.100.244, 192.168.100.245 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.2 dial up... OK talk to server... OK Still not seeing any logs though unfortunately. On Logstash Logs seeing this error now: _Caused by: javax.net.ssl.SSLHandshakeException: error:100000f7:SSL routines:OPENSSL\_internal:WRONG\_VERSION\_NUMBER_ ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 4, 2018, 12:19am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/16 "2018-04-04T00:19:19Z")
> [@patricktula](#): > > Still not seeing any logs though unfortunately. You could try deleting the registry file to see if it then resends all data. > [@patricktula](#): > > Caused by: javax.net.ssl.SSLHandshakeException: error:100000f7:SSL routines:OPENSSL\_internal:WRONG\_VERSION\_NUMBER Do you have more than this one client sending data to Logstash? Is there any other client that could be misconfigured. The exception should an IP and port associated with the client. ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 4, 2018, 3:59am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/17 "2018-04-04T03:59:03Z")
It's working! Awesome support here Mr. Kroh. Thank you very much. Have a great night sir! ---
**Author:** ![patricktula](https://avatars.discourse-cdn.com/v4/letter/p/3be4f8/32.png) [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Post date:** [April 4, 2018, 3:59am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/18 "2018-04-04T03:59:55Z")
BTW: Got Filebeats working as well with SSL using same format! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 2, 2018, 4:00am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502/19 "2018-05-02T04:00:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.