{"id":16149,"date":"2023-04-10T14:01:35","date_gmt":"2023-04-10T11:01:35","guid":{"rendered":"https:\/\/kifarunix.com\/?p=16149"},"modified":"2024-03-10T08:57:14","modified_gmt":"2024-03-10T05:57:14","slug":"easily-configure-elasticsearch-https-connection","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/easily-configure-elasticsearch-https-connection\/","title":{"rendered":"Easily Configure Elasticsearch HTTPS Connection"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to easily configure Elasticsearch HTTPS Connection. You can configure your Beats; Filebeat, Metricbeat, Packetbeat, Logstash, Kibana, to securely connect to Elasticsearch via SSL\/TLS mutual communication between them.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#configuring-elasticsearch-https-connection\">Configuring Elasticsearch HTTPS Connection<\/a><ul><li><a href=\"#install-and-setup-elk-stack\">Install and Setup ELK Stack<\/a><\/li><li><a href=\"#generate-elk-stack-ca-and-server-tls-certificates\">Generate\u00a0ELK Stack CA and Server TLS Certificates<\/a><ul><li><a href=\"#elasticsearch-8-x-autogenerated-ca-and-tls-certificates\">Elasticsearch 8.x Autogenerated CA and TLS Certificates<\/a><\/li><li><a href=\"#generate-elk-stack-ca-and-server-tls-certificates-1\">Generate\u00a0ELK Stack CA and Server TLS Certificates<\/a><\/li><\/ul><\/li><li><a href=\"#configuring-elasticsearch-for-https-connection\">Configuring Elasticsearch for HTTPS Connection<\/a><\/li><li><a href=\"#configure-kibana-elasticsearch-https-connection\">Configure Kibana Elasticsearch HTTPS connection<\/a><\/li><li><a href=\"#configure-logstash-elasticsearch-https-connection\">Configure Logstash Elasticsearch HTTPS Connection<\/a><\/li><li><a href=\"#configure-filebeat-for-elasticsearch-ssl-tls-communication\">Configure Filebeat for Elasticsearch SSL\/TLS communication<\/a><\/li><li><a href=\"#related-tutorials\">Related Tutorials<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuring-elasticsearch-https-connection\">Configuring Elasticsearch HTTPS Connection<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-and-setup-elk-stack\">Install and Setup ELK Stack<\/h3>\n\n\n\n<p>Before you can proceed, we assume that you have already installed and setup ELK stack. Otherwise, you can follow any of the guides below to install and setup Elastic Stack;<\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/install-elastic-elk-stack-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install ELK Stack on Linux<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"generate-elk-stack-ca-and-server-tls-certificates\">Generate&nbsp;ELK Stack CA and Server TLS Certificates<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"elasticsearch-8-x-autogenerated-ca-and-tls-certificates\">Elasticsearch 8.x Autogenerated CA and TLS Certificates<\/h4>\n\n\n\n<p>In our setup, we are running Elastic Stack 8.x. When you deploy Elasticsearch 8.x, authentication and authorization, TLS for the transport and HTTP layers is enabled and configured by default.<\/p>\n\n\n\n<p>You can confirm this by checking the Elasticsearch 8.x configuration file, <code>\/etc\/elasticsearch\/elasticsearch.yml<\/code>.<\/p>\n\n\n\n<p>See sample configuration below;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------\n#\n# The following settings, TLS certificates, and keys have been automatically      \n# generated to configure Elasticsearch security features on 10-04-2023 06:16:19\n#\n# --------------------------------------------------------------------------------\n\n<strong># Enable security features\nxpack.security.enabled: true\n\nxpack.security.enrollment.enabled: true\n\n# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents\nxpack.security.http.ssl:\n  enabled: true\n  keystore.path: certs\/http.p12\n\n# Enable encryption and mutual authentication between cluster nodes\nxpack.security.transport.ssl:\n  enabled: true\n  verification_mode: certificate\n  keystore.path: certs\/transport.p12\n  truststore.path: certs\/transport.p12<\/strong>\n# Create a new cluster with the current node only\n# Additional nodes can still join the cluster later\ncluster.initial_master_nodes: [\"debian11\"]\n\n# Allow HTTP API connections from anywhere\n# Connections are encrypted and require user authentication\nhttp.host: 0.0.0.0\n\n# Allow other nodes to join the cluster from anywhere\n# Connections are encrypted and mutually authenticated\n#transport.host: 0.0.0.0\n\n#----------------------- END SECURITY AUTO CONFIGURATION -------------------------\n<\/code><\/pre>\n\n\n\n<p>The CA and self signed TLS certificates are generated by default and stored under <strong><code>\/etc\/elasticsearch\/certs\/<\/code><\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -1 \/etc\/elasticsearch\/certs\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>http_ca.crt\nhttp.p12\ntransport.p12<\/code><\/pre>\n\n\n\n<p>The certificates are in Public Key Cryptography Standard #12 (PKCS12) format. If you want to use this certificates with other endpoints such as Kibana, Logstash, Beats to secure connection connection with Elasticsearch, you will have to convert the PKCS12 certs into Privacy-Enhance Mail (PEM) format.<\/p>\n\n\n\n<p>Beware that the certificates auto-generated usually have a validity period of 3 years.<\/p>\n\n\n\n<p>With the above, you just have to configure your nodes to use HTTP and CA files as appropriately.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"generate-elk-stack-ca-and-server-tls-certificates-1\">Generate&nbsp;ELK Stack CA and Server TLS Certificates<\/h4>\n\n\n\n<p>If you are using a version of Elastic stack other than Elastic 8.x, or maybe you upgraded from Elastic 7.x to Elastic 8.x and you just setup only HTTPS connection between Elasticsearch cluster nodes, then you need to use your own TLS certificates.<\/p>\n\n\n\n<p>You can use commercial certificates or simply generate the self-signed ones!<\/p>\n\n\n\n<p>On Elasticsearch, you can generate TLS certificates using <code><strong>elasticsearch-certutil<\/strong><\/code> command.<\/p>\n\n\n\n<p><code><strong>elasticsearch-certutil<\/strong><\/code> is an Elastic Stack utility that simplifies the generation of X.509 certificates and certificate signing requests for use with SSL\/TLS in the Elastic stack.<\/p>\n\n\n\n<p>With <strong><code>elasticsearch-certutil<\/code><\/strong>, it is possible to generate the certificates for a specific node or multiple nodes.<\/p>\n\n\n\n<p>More IMPORTANTLY, if you have multiple Elasticsearch nodes or you plan to add more nodes to your cluster in the future, and you want to generate a single certificate that can be used with all of them, use <strong><code>--dns<\/code><\/strong> option with wildcard.<\/p>\n\n\n\n<p>Create a directory to store the certificates if you don&#8217;t have one already.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;&#91; -d \/etc\/elasticsearch\/certs ]] || mkdir \/etc\/elasticsearch\/certs<\/code><\/pre>\n\n\n\n<p>Generate the Certificate Authority (CA). By default, the CA is generated in PKCS#12 format. Hence, to get them in the usual PEM format, pass <strong><code>--pem<\/code><\/strong> option.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/elasticsearch\/bin\/elasticsearch-certutil ca \\\n--pem \\\n--days 3650 \\\n--out \/etc\/elasticsearch\/certs\/elkstack-ca.zip<\/code><\/pre>\n\n\n\n<p>The output zip file will contain individual files for the CA certificate and private key<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>unzip -l \/etc\/elasticsearch\/certs\/elkstack-ca.zip<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\nArchive:  \/etc\/elasticsearch\/certs\/elkstack-ca.zip\n  Length      Date    Time    Name\n---------  ---------- -----   ----\n        0  2023-04-10 11:03   ca\/\n     1200  2023-04-10 11:03   ca\/ca.crt\n     1675  2023-04-10 11:03   ca\/ca.key\n---------                     -------\n     2875                     3 files\n<\/code><\/pre>\n\n\n\n<p>Unzip the file to get the CA required to generate the TLS certs.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>unzip -d \/etc\/elasticsearch\/certs \/etc\/elasticsearch\/certs\/elkstack-ca.zip<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\nArchive:  \/etc\/elasticsearch\/certs\/elkstack-ca.zip\n   creating: \/etc\/elasticsearch\/certs\/ca\/\n  inflating: \/etc\/elasticsearch\/certs\/ca\/ca.crt  \n  inflating: \/etc\/elasticsearch\/certs\/ca\/ca.key\n<\/code><\/pre>\n\n\n\n<p>You should now have the <strong>ca\/ca.crt<\/strong> and <strong>ca\/ca.key<\/strong> in the certs directory.<\/p>\n\n\n\n<p>Be sure to keep you private keys as secure as possible.<\/p>\n\n\n\n<p>Next, generate the certificates (in PEM format) using the CA generate above.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/elasticsearch\/bin\/elasticsearch-certutil cert \\\n--name elkstack-certs \\\n--ca-cert \/etc\/elasticsearch\/certs\/ca\/ca.crt \\\n--ca-key \/etc\/elasticsearch\/certs\/ca\/ca.key \\\n--pem \\\n--dns '*.kifarunix-demo.com' \\\n--days 3650 \\\n--out \/etc\/elasticsearch\/certtest\/elkstack-certs.zip<\/code><\/pre>\n\n\n\n<p>Extract the certificate files.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>unzip -d \/etc\/elasticsearch\/certs \/etc\/elasticsearch\/certs\/elkstack-certs.zip<\/code><\/pre>\n\n\n\n<p>The certificate file and key will now be stored under <strong><code>\/etc\/elasticsearch\/certs\/elkstack-certs<\/code><\/strong> directory.<\/p>\n\n\n\n<p>Read more about the elasticsearch-certutil tool on <a aria-label=\"Elasticsearch reference page (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/certutil.html\" target=\"_blank\" rel=\"noreferrer noopener\">Elasticsearch reference page<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configuring-elasticsearch-for-https-connection\">Configuring Elasticsearch for HTTPS Connection<\/h3>\n\n\n\n<p>To ensure that any HTTP connection to Elasticsearch is encrypted with TLS, you need to configure Elasticsearch for the same.<\/p>\n\n\n\n<p>The configuration options for enabling SSL\/TLS encryption for HTTP traffic in Elasticsearch are;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>xpack.security.http.ssl.enabled<\/code>: set to <code>true<\/code> to enable SSL\/TLS encryption for HTTP traffic.<\/li>\n\n\n\n<li><code>xpack.security.http.ssl.key<\/code>: specifies the path to the SSL\/TLS private key file, in either PEM or PKCS format.<\/li>\n\n\n\n<li><code>xpack.security.http.ssl.certificate<\/code>: specifies the path to the SSL\/TLS certificate file, in either PEM or PKCS format.<\/li>\n\n\n\n<li><code>xpack.security.http.ssl.certificate_authorities<\/code>: specifies the path to one or more SSL\/TLS certificate authority (CA) certificate files, in either PEM or PKCS format.<\/li>\n<\/ul>\n\n\n\n<p>Thus, to enable Elasticsearch HTTPS connection, add these following configuration options with proper paths to the files as shown below, on <strong>ALL the nodes in the cluster<\/strong>. You need to copy certs files to all nodes.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat >> \/etc\/elasticsearch\/elasticsearch.yml &lt;&lt; 'EOL'\nxpack.security.http.ssl.enabled: true\nxpack.security.http.ssl.key: \/etc\/elasticsearch\/certs\/elkstack-certs\/elkstack-certs.key\nxpack.security.http.ssl.certificate: \/etc\/elasticsearch\/certs\/elkstack-certs\/elkstack-certs.crt\nxpack.security.http.ssl.certificate_authorities: \/etc\/elasticsearch\/certs\/ca\/ca.crt\nEOL\n<\/code><\/pre>\n\n\n\n<p>Note that the HTTP certificate files are different from Transport files.<\/p>\n\n\n\n<p>Once you put the configurations in the file, save and exit and restart Elasticsearch;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart elasticsearch<\/code><\/pre>\n\n\n\n<p>After this, any connection to Elasticsearch will required the CA certificate to connect. The endoint URL must be HTTPS.<\/p>\n\n\n\n<p>For example, to get the nodes on the cluster, you can use such command as;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl https:\/\/node02.kifarunix-demo.com:9200\/_cat\/nodes?v -u elastic --cacert \/etc\/elasticsearch\/certs\/ca\/ca.crt<\/code><\/pre>\n\n\n\n<p>Note that, <strong><code>https:\/\/node.DOMAIN<\/code><\/strong>. The domain part is specified with <strong><code>--dns <\/code><\/strong>option above.<\/p>\n\n\n\n<p>Also, specify the path to the CA cert file.<\/p>\n\n\n\n<p>Sample output of the above command;<\/p>\n\n\n\n<pre class=\"scroll-sz\"><code>\nEnter host password for user 'elastic':\nip             heap.percent ram.percent cpu load_1m load_5m load_15m node.role   master name\n192.168.58.22            23          64   3    0.36    0.47     0.42 cdfhilmrstw -      node01\n192.168.56.10            46          96  12    0.53    0.81     0.64 dim         -      node02\n192.168.56.154           54          96   5    0.73    1.35     1.89 dim         *      node03\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-kibana-elasticsearch-https-connection\">Configure Kibana Elasticsearch HTTPS connection<\/h3>\n\n\n\n<p>Since you have enabled Elasticsearch HTTPS connection, you need to configure every app that connects to Elasticsearch to use HTTPS connection to Elasticsearch.<\/p>\n\n\n\n<p>All you need is just to copy the CA certificates files to each endpoint and make appropriate configurations.<\/p>\n\n\n\n<p>In this setup, we have already copied the CA file into \/etc\/kibana\/ca.crt;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -alh \/etc\/kibana\/ca.crt<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>-rw-r--r-- 1 root kibana 1.2K Apr 10 12:26 \/etc\/kibana\/ca.crt<\/code><\/pre>\n\n\n\n<p>Next, configure Kibana to connect to Elasticsearch via HTTPS by changing the URLs of the Elasticsearch instances and defining path to CA file.<\/p>\n\n\n\n<p>In my setup, this is how it looks like in the beginning;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>elasticsearch.hosts: &#91;\"http:\/\/192.168.58.22:9200\"]<\/code><\/pre>\n\n\n\n<p>So, replace the URL accordingly.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i.bak '\/^elasticsearch.hosts\/s\/\"&#91;^\"]*\"\/https:\\\/\\\/node01.kifarunix-demo.com:9200\/' \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<p>Let&#8217;s confirm;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>elasticsearch.hosts: &#91;https:\/\/node01.kifarunix-demo.com:9200]\nelasticsearch.ssl.certificateAuthorities: &#91; \"\/etc\/kibana\/ca.crt\" ]<\/code><\/pre>\n\n\n\n<p>Restart Kibana;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart kibana<\/code><\/pre>\n\n\n\n<p>There you go. Now access Kibana and see if all is good!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-logstash-elasticsearch-https-connection\">Configure Logstash Elasticsearch HTTPS Connection<\/h3>\n\n\n\n<p>Next, copy the CA certificate to the relevant configuration directory on Logstash node.<\/p>\n\n\n\n<p>In this setup, we install the certs\/keys on the <code>\/etc\/logstash<\/code> directory;<\/p>\n\n\n\n<p>Configure Logstash Elasticsearch HTTPS connection;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/logstash\/conf.d\/test.conf<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\ninput {\n  beats {\n    port => 5044\n  }\n}\noutput {\n   elasticsearch {\n    hosts => [\"https:\/\/node01.kifarunix-demo.com:9200\"]\n    cacert => \"\/etc\/logstash\/ca.crt\"\n    user => \"${ES_USER}\"\n    password => \"${ES_PASSWORD}\"\n }\n}\n<\/code><\/pre>\n\n\n\n<p>Save and exit the configuration file.<\/p>\n\n\n\n<p>Before you can run Logstash, it is a good idea to check for any configuration errors;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/usr\/share\/logstash\/bin\/logstash --path.settings \/etc\/logstash -f \/etc\/logstash\/conf.d\/test.conf -t<\/code><\/pre>\n\n\n\n<p>If all is well, you should see such lines from the command output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Configuration OK<\/code><\/pre>\n\n\n\n<p>You can now run Logstash in debugging mode just to see if any error arises as per your Elasticsearch output configuration file;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/usr\/share\/logstash\/bin\/logstash -f \/etc\/logstash\/conf.d\/<strong>test.conf<\/strong> --path.settings \/etc\/logstash\/<\/code><\/pre>\n\n\n\n<p>Ensure that there is no error! if any fix it and proceed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-filebeat-for-elasticsearch-ssl-tls-communication\">Configure Filebeat for Elasticsearch SSL\/TLS communication<\/h3>\n\n\n\n<p>Assuming you have already installed Filebeat on a system you want to collect logs from, configure it for Elasticsearch TLS communication as follows;<\/p>\n\n\n\n<p>Copy the CA certificate from the Elasticsearch cluster to the system where Filebeat is installed.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>scp \/path\/ro\/ca\/ca.crt username@filebeat-host:<\/code><\/pre>\n\n\n\n<p>Once you have copied the CA certificate to the remote host running filebeat, proceed to configure Elasticsearch HTTPS communication.<\/p>\n\n\n\n<p>Place the copied CA certificate at some relevant directory, e.g \/etc\/filebeat;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cp $HOME\/ca.crt \/etc\/filebeat<\/code><\/pre>\n\n\n\n<p>Now configure Filebeat to use SSL\/TLS by specifying the path to CA cert on the Elasticsearch output config section (note that, I also enabled basic authentication);<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim \/etc\/filebeat\/filebeat.yml<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\noutput.elasticsearch:\n<strong>  hosts: [\"https:\/\/node01.kifarunix-demo.com:9200\"]\n  ssl.certificate_authorities: [\"\/etc\/filebeat\/ca.crt\"]\n  ssl.verification_mode: full<\/strong>\n  username: \"ES_USERNAME\"\n  password: \"ES_PASSWORD\"\n<\/code><\/pre>\n\n\n\n<p><strong>Ensure that the Elasticsearch hostname matches the FQDN used while creating the certificates<\/strong>.<\/p>\n\n\n\n<p>Save the configuration file and exit.<\/p>\n\n\n\n<p>Validate the Elasticsearch server\u2019s certificate: Before you can run Filebeat, you need to validate the Elasticsearch server&#8217;s certificate trust.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>curl -v --cacert \/etc\/filebeat\/ca.crt https:\/\/node01.kifarunix-demo.com:9200 -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nEnter host password for user 'elastic':\n*   Trying 192.168.58.22:9200...\n* Connected to node01.kifarunix-demo.com (192.168.58.22) port 9200 (#0)\n* ALPN, offering h2\n* ALPN, offering http\/1.1\n*  CAfile: \/etc\/filebeat\/ca.crt\n*  CApath: \/etc\/ssl\/certs\n* TLSv1.0 (OUT), TLS header, Certificate Status (22):\n* TLSv1.3 (OUT), TLS handshake, Client hello (1):\n* TLSv1.2 (IN), TLS header, Certificate Status (22):\n* TLSv1.3 (IN), TLS handshake, Server hello (2):\n* TLSv1.2 (IN), TLS header, Finished (20):\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):\n* TLSv1.3 (IN), TLS handshake, Certificate (11):\n* TLSv1.3 (IN), TLS handshake, CERT verify (15):\n* TLSv1.3 (IN), TLS handshake, Finished (20):\n* TLSv1.2 (OUT), TLS header, Finished (20):\n* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n* TLSv1.3 (OUT), TLS handshake, Finished (20):\n* SSL connection using TLSv1.3 \/ TLS_AES_256_GCM_SHA384\n* ALPN, server did not agree to a protocol\n* Server certificate:\n*  subject: CN=elkstack-certs\n*  start date: Apr 10 08:18:16 2023 GMT\n*  expire date: Apr  7 08:18:16 2033 GMT\n*  subjectAltName: host \"node01.kifarunix-demo.com\" matched cert's \"*.kifarunix-demo.com\"\n*  issuer: CN=Elastic Certificate Tool Autogenerated CA\n*  SSL certificate verify ok.\n* Server auth using Basic with user 'elastic'\n* TLSv1.2 (OUT), TLS header, Supplemental data (23):\n> GET \/ HTTP\/1.1\n> Host: node01.kifarunix-demo.com:9200\n> Authorization: Basic ZWxhc3RpYzpzOWx1NW5zNk9JR21oSkUxelcxZw==\n> User-Agent: curl\/7.81.0\n> Accept: *\/*\n> \n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):\n* TLSv1.2 (IN), TLS header, Supplemental data (23):\n* Mark bundle as not supporting multiuse\n< HTTP\/1.1 200 OK\n< X-elastic-product: Elasticsearch\n< content-type: application\/json\n< content-length: 529\n< \n{\n  \"name\" : \"node01\",\n  \"cluster_name\" : \"elasticsearch\",\n  \"cluster_uuid\" : \"pE3v-1oSTfaiF3Dp2VbOjg\",\n  \"version\" : {\n    \"number\" : \"8.7.0\",\n    \"build_flavor\" : \"default\",\n    \"build_type\" : \"deb\",\n    \"build_hash\" : \"09520b59b6bc1057340b55750186466ea715e30e\",\n    \"build_date\" : \"2023-03-27T16:31:09.816451435Z\",\n    \"build_snapshot\" : false,\n    \"lucene_version\" : \"9.5.0\",\n    \"minimum_wire_compatibility_version\" : \"7.17.0\",\n    \"minimum_index_compatibility_version\" : \"7.0.0\"\n  },\n  \"tagline\" : \"You Know, for Search\"\n}\n* Connection #0 to host node01.kifarunix-demo.com left intact\n<\/code><\/pre>\n\n\n\n<p>Testing Filebeat Configuration. Run Filebeat in debugging mode to check if all is well.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>filebeat test config<\/code><\/pre>\n\n\n\n<p>You should get, <strong>Config OK<\/strong>, if all good.<\/p>\n\n\n\n<p>Test connection to Elasticsearch;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>filebeat test output<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nelasticsearch: https:\/\/node01.kifarunix-demo.com:9200...\n  parse url... OK\n  connection...\n    parse host... OK\n    dns lookup... OK\n    addresses: 192.168.58.22\n    dial up... OK\n  TLS...\n    security... WARN server's certificate chain verification is disabled\n    handshake... OK\n    TLS version: TLSv1.3\n    dial up... OK\n  talk to server... OK\n  version: 8.7.0\n<\/code><\/pre>\n\n\n\n<p>Start the filebeat and log to stderr<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>filebeat -e<\/code><\/pre>\n\n\n\n<p>If there is any error, you will see on the console.<\/p>\n\n\n\n<p>Otherwise, if you get such a line, all is good;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>Connection to backoff(elasticsearch(https:\/\/URL:9200)) established<\/strong><\/code><\/pre>\n\n\n\n<p>Press ctrl+c to cancel above and start filebeat<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart filebeat<\/code><\/pre>\n\n\n\n<p>This applies all Elastic Beats. configure them for Elasticsearch HTTPS connection the same way you have configured Filebeat.<\/p>\n\n\n\n<p>And that marks the end an easy way to configure Elasticsearch HTTPS Connection. Enjoy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"related-tutorials\">Related Tutorials<\/h3>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-nextcloud-with-nginx-and-ssl-tls-certificates-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install Nextcloud with Nginx and SSL\/TLS Certificates on CentOS 8<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/configure-apache-with-ssl-tls-certificates-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Configure Apache with SSL\/TLS Certificates on CentOS 8<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/configure-nginx-with-ssl-tls-certificates-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Configure Nginx with SSL\/TLS certificates on CentOS 8<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-ssl-tls-certificates-expiry-with-nagios\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Monitor SSL\/TLS Certificates Expiry with Nagios<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to easily configure Elasticsearch HTTPS Connection. You can configure your Beats; Filebeat, Metricbeat, Packetbeat, Logstash, Kibana, to securely<\/p>\n","protected":false},"author":10,"featured_media":16160,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,910,121,72],"tags":[6519,3596,6517,6524,6523,6525,6526,6518],"class_list":["post-16149","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-elastic-stack","category-howtos","category-monitoring","tag-easily-configure-elasticsearch-https-connection","tag-elasticsearch-https","tag-elasticsearch-tls","tag-filebeat-elasticsearch-https-connection","tag-kibana-elasticsearch-https-connection","tag-logstash-elasticsearch-https-connection","tag-metricbeat-elasticsearch-https-connection","tag-secure-elasticsearch-with-https","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16149"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=16149"}],"version-history":[{"count":12,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16149\/revisions"}],"predecessor-version":[{"id":20728,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16149\/revisions\/20728"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/16160"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=16149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=16149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=16149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}