How-to-configure-SSL-for-FileBeat-and-Logstash-step-by-step

The official Elasticsearch guide stops short of creating keys and certificates, so this walkthrough fills that gap with OpenSSL, covering mutual authentication.

Elasticsearch documents how to secure communication with Logstash using SSL, but the README points out the hole: that documentation never shows how to create the necessary keys and certificates with openssl. Creating a CA and the CSRs is not difficult, just tedious if openssl is not second nature. This guide exists to fill that specific blank. The intended reader is an administrator wiring secure log shipping between the two Elastic stack components.

The end state is Filebeat talking to Logstash over SSL with mutual authentication and TLS 2.0 encryption. Mutual authentication means both sides verify each other, so both need certificates, not just one. The steps were tested on Logstash and Filebeat version 5.6, which gives the reader a concrete reference point for the environment.

The core of the walkthrough is the certificate pipeline: create the certificate authority, generate certificate signing requests for the services, and produce the certificates for Filebeat on the output side and Logstash on the input side. That is the part the official documentation omits, and the guide works through it in order so the two services can trust each other over the wire.

The README also lists some errors that show up in the FileBeat and Logstash logs when SSL is not configured properly. These give you something concrete to grep for during setup. When a certificate is wrong or the config is off, the failure appears in the logs, and having the common examples saves a round of head scratching.

• Source 1 · Project repository
• Source 2 · README