# Certificate issue while installing filebeat

**URL:** <https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414>\
**Category:** Search Guard\
**Created:** [April 3, 2019, 7:52am UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414 "2019-04-03T07:52:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nehajain0031](https://avatars.discourse-cdn.com/v4/letter/n/8edcca/32.png) [@nehajain0031](https://forum.search-guard.com/u/nehajain0031)\
**Post date:** [April 3, 2019, 7:52am UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/1 "2019-04-03T07:52:23Z")

</div>

When posting in this category, please add:

- [Elasticsearch logfiles on debug level](https://docs.search-guard.com/latest/troubleshooting-setting-log-level)

- Your Search Guard configuration files  
[sg\_config.yml](https://forum.search-guard.com/uploads/short-url/6kYvUpbczaJJJ6Sro466lvgollv.yml) (9.4 KB)

- Your elasticsearch.yml configuration file  
[elasticsearch.yml](https://forum.search-guard.com/uploads/short-url/4bobgyK0ayLBn49v5XESGHCOp7V.yml) (3.8 KB)

If you are using Kibana, please also add:

- Your kibana.yml configuration file\<a class=“attachment”  
[kibana.yml](https://forum.search-guard.com/uploads/short-url/9O8t0efX41zzDpNGdCPxuGvacSN.yml) (6.9 KB)

I am trying to install filebeat.  
filebeat.yml  
[filebeat.yml](https://forum.search-guard.com/uploads/short-url/cIF5ygaIFNkN2ZmAGQUOcQVPpwT.yml) (7.7 KB)

I have run the following commands  
.\install-service-filebeat.ps1

filebeat.exe modules enable elasticsearch

When running filebeat.exe setup  
I got following error  
Exiting: Couldn’t connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch https  
://localhost:9200: Get [https://localhost:9200](https://localhost:9200): x509: certificate signed by unknown authority]

I m using dummy certificates for searchguard

Please help

---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [April 3, 2019, 2:32pm UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/3 "2019-04-03T14:32:35Z")

</div>

Unassigned @pablo.lescotti on April 3, 2019, 2:32pm UTC



---

<div class="post-metadata">

**Author:** ![pablo.lescotti](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo.lescotti/32/635_2.png) [@pablo.lescotti](https://forum.search-guard.com/u/pablo.lescotti)\
**Post date:** [April 3, 2019, 7:36pm UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/4 "2019-04-03T19:36:38Z")

</div>

Did You take a look at one of our recent posts?

> **[Log ingestion with Beats, Logstash and Search Guard](https://search-guard.com/beats-logstash-searchguard/)**
>
> How to configure Search Guard with Elasticsearch log analytics tools like Beats and logstash to protect log data in your cluster.

This provides step-by-step demo very similar to Your use case. There are some tiny differences in filebeat.yml configuration. You can try if they make a difference. Let us know if this helps.

---

<div class="post-metadata">

**Author:** ![nehajain0031](https://avatars.discourse-cdn.com/v4/letter/n/8edcca/32.png) [@nehajain0031](https://forum.search-guard.com/u/nehajain0031)\
**Post date:** [April 4, 2019, 9:45am UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/5 "2019-04-04T09:45:17Z")

</div>

I was using searchguard demo certifiates.  
While installing Beat, I got stucked at following issue  
Exiting: Couldn’t connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch https  
://localhost:9200: Get [https://localhost:9200](https://localhost:9200/): x509: certificate signed by unknown authority]

I edited my filebeat.yml to include certificates and keys

```auto
output.elasticsearch:
hosts: [“[https://localhost:9200](https://localhost:9200/)”]
index: “beats-%{+yyyy.MM.dd}”
ssl.enabled: true
#List of root certificates for HTTPS server verifications
ssl.certificate_authorities: [“E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/root-ca.pem”]
#Certificate for SSL client authentication
ssl.certificate: “E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/esnode.pem”
#Client Certificate Key
ssl.key: “E:/Elastic_Search/elk-6.5.4/elasticsearch-6.5.4/config/esnode-key.pem”

# Optional protocol and basic auth credentials.

#protocol: “https”
username: “admin”
password: “admin”

The above issue got resolved after that.

**But I got stucked in new issue after that while running last command**
*Start-Service filebeat*

*#[No paths were defined for input accessing config]*
```

---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [April 4, 2019, 10:08am UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/6 "2019-04-04T10:08:46Z")

</div>

Assigned @pablo.lescotti on April 4, 2019, 10:08am UTC



---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 5, 2019, 9:12am UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/7 "2019-04-05T09:12:37Z")

</div>

Closed on April 5, 2019, 9:12am UTC



---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [April 5, 2019, 1:37pm UTC](https://forum.search-guard.com/t/certificate-issue-while-installing-filebeat/1414/8 "2019-04-05T13:37:40Z")

</div>

Unassigned @pablo.lescotti on April 5, 2019, 1:37pm UTC