Certificate issue while installing filebeat

Search Guard
1

When posting in this category, please add:

If you are using Kibana, please also add:

  • Your kibana.yml configuration file<a class=“attachment”
    kibana.yml (6.9 KB)

I am trying to install filebeat.
filebeat.yml
filebeat.yml (7.7 KB)

I have run the following commands
.\install-service-filebeat.ps1

filebeat.exe modules enable elasticsearch

When running filebeat.exe setup
I got following error
Exiting: Couldn’t connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch https
://localhost:9200: Get https://localhost:9200: x509: certificate signed by unknown authority]

I m using dummy certificates for searchguard

Please help

4

Did You take a look at one of our recent posts?

This provides step-by-step demo very similar to Your use case. There are some tiny differences in filebeat.yml configuration. You can try if they make a difference. Let us know if this helps.

5

I was using searchguard demo certifiates.
While installing Beat, I got stucked at following issue
Exiting: Couldn’t connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch https
://localhost:9200: Get https://localhost:9200: x509: certificate signed by unknown authority]

I edited my filebeat.yml to include certificates and keys

output.elasticsearch:
hosts: [“[https://localhost:9200](https://localhost:9200/)”]
index: “beats-%{+yyyy.MM.dd}”
ssl.enabled: true
#List of root certificates for HTTPS server verifications
ssl.certificate_authorities: [“E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/root-ca.pem”]
#Certificate for SSL client authentication
ssl.certificate: “E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/esnode.pem”
#Client Certificate Key
ssl.key: “E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/esnode-key.pem”

# Optional protocol and basic auth credentials.

#protocol: “https”
username: “admin”
password: “admin”

The above issue got resolved after that.

**But I got stucked in new issue after that while running last command**
*Start-Service filebeat*

*#[No paths were defined for input accessing config]*