Skip to content

[9.1](backport #46457) Doc: Use current Logstash SSL settings for auditbeat #46650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 16, 2025
Merged

[9.1](backport #46457) Doc: Use current Logstash SSL settings for auditbeat #46650

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
34a6de7
Doc: Use current Logstash SSL settings for auditbeat (#46457)
karenzone Sep 15, 2025
68b087a
Merge branch '9.1' into mergify/bp/9.1/pr-46457
karenzone Sep 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions docs/reference/auditbeat/configuring-ssl-logstash.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,41 +17,41 @@ To use SSL mutual authentication:
If you are using {{security-features}}, you can use the [elasticsearch-certutil tool](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md) to generate certificates.
::::

2. Configure Auditbeat to use SSL. In the `auditbeat.yml` config file, specify the following settings under `ssl`:
2. Configure Auditbeat to use SSL. In the `auditbeat.yml` config file, specify these settings under `ssl`:

* `certificate_authorities`: Configures Auditbeat to trust any certificates signed by the specified CA. If `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
* `certificate` and `key`: Specifies the certificate and key that Auditbeat uses to authenticate with Logstash.
* `certificate_authorities`. Configures Auditbeat to trust any certificates signed by the specified CA. If `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
* `certificate` and `key`. Specifies the certificate and key that Auditbeat uses to authenticate with Logstash.

For example:

```yaml
output.logstash:
hosts: ["logs.mycompany.com:5044"]
hosts: ["logs.example.com:5044"]
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"
```

For more information about these configuration options, see [SSL](/reference/auditbeat/configuration-ssl.md).

3. Configure Logstash to use SSL. In the Logstash config file, specify the following settings for the [Beats input plugin for Logstash](logstash-docs-md://lsr/plugins-inputs-beats.md):
3. Configure Logstash to use SSL. In the Logstash config file, specify these settings for the [Beats input plugin for Logstash](logstash-docs-md://lsr/plugins-inputs-beats.md):

* `ssl`: When set to true, enables Logstash to use SSL/TLS.
* `ssl_certificate_authorities`: Configures Logstash to trust any certificates signed by the specified CA.
* `ssl_certificate` and `ssl_key`: Specify the certificate and key that Logstash uses to authenticate with the client.
* `ssl_verify_mode`: Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either `peer` or `force_peer` to make the server ask for the certificate and validate it. If you specify `force_peer`, and Auditbeat doesn’t provide a certificate, the Logstash connection will be closed. If you choose not to use [certutil](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md), the certificates that you obtain must allow for both `clientAuth` and `serverAuth` if the extended key usage extension is present.
* `ssl`. When set to true, enables Logstash to use SSL/TLS.
* `ssl_certificate_authorities`. Configures Logstash to trust any certificates signed by the specified CA.
* `ssl_certificate` and `ssl_key`. Specify the certificate and key that Logstash uses to authenticate with the client.
* `ssl_client_authentication`. Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either `required` or `optional` to make the server ask for the certificate and validate it. If you specify `required`, and Auditbeat doesn’t provide a certificate, the Logstash connection will be closed. If you choose not to use [certutil](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md), the certificates that you obtain must allow for both `clientAuth` and `serverAuth` if the extended key usage extension is present.

For example:

```json
input {
beats {
port => 5044
ssl => true
ssl_enabled => true
ssl_certificate_authorities => ["/etc/ca.crt"]
ssl_certificate => "/etc/server.crt"
ssl_key => "/etc/server.key"
ssl_verify_mode => "force_peer"
ssl_client_authentication => "required"
}
}
```
Expand All @@ -65,35 +65,35 @@ To use SSL mutual authentication:
Before running Auditbeat, you should validate the Logstash server’s certificate. You can use `curl` to validate the certificate even though the protocol used to communicate with Logstash is not based on HTTP. For example:

```shell
curl -v --cacert ca.crt https://logs.mycompany.com:5044
curl -v --cacert ca.crt https://logs.example.com:5044
```

If the test is successful, you’ll receive an empty response error:

```shell
* Rebuilt URL to: https://logs.mycompany.com:5044/
* Rebuilt URL to: https://logs.example.com:5044/
* Trying 192.168.99.100...
* Connected to logs.mycompany.com (192.168.99.100) port 5044 (#0)
* TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate: logs.mycompany.com
* Server certificate: mycompany.com
* Connected to logs.example.com (192.168.99.100) port 5044 (#0)
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* Server certificate: logs.example.com
* Server certificate: example.com
> GET / HTTP/1.1
> Host: logs.mycompany.com:5044
> Host: logs.example.com:5044
> User-Agent: curl/7.43.0
> Accept: */*
>
* Empty reply from server
* Connection #0 to host logs.mycompany.com left intact
* Connection #0 to host logs.example.com left intact
curl: (52) Empty reply from server
```

The following example uses the IP address rather than the hostname to validate the certificate:
This example uses the IP address rather than the hostname to validate the certificate:

```shell
curl -v --cacert ca.crt https://192.168.99.100:5044
```

Validation for this test fails because the certificate is not valid for the specified IP address. It’s only valid for the `logs.mycompany.com`, the hostname that appears in the Subject field of the certificate.
Validation for this test fails because the certificate is not valid for the specified IP address. It’s only valid for the `logs.example.com`, the hostname that appears in the Subject field of the certificate.

```shell
* Rebuilt URL to: https://192.168.99.100:5044/
Expand Down
Loading