# how to configure metricbeat connect to elasticsearch with ssl

**URL:** <https://forum.search-guard.com/t/how-to-configure-metricbeat-connect-to-elasticsearch-with-ssl/1223>\
**Category:** Search Guard\
**Created:** [November 28, 2018, 5:49pm UTC](https://forum.search-guard.com/t/how-to-configure-metricbeat-connect-to-elasticsearch-with-ssl/1223 "2018-11-28T17:49:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Konstantin\_Fetisov](https://avatars.discourse-cdn.com/v4/letter/k/a3d4f5/32.png) [@Konstantin\_Fetisov](https://forum.search-guard.com/u/Konstantin_Fetisov)\
**Post date:** [November 28, 2018, 5:49pm UTC](https://forum.search-guard.com/t/how-to-configure-metricbeat-connect-to-elasticsearch-with-ssl/1223/1 "2018-11-28T17:49:28Z")

</div>

I try configure metricbeat to ssl connect, but when start metricbeat i have this error:

2018-11-28T17:43:31.512Z INFO instance/beat.go:286 Setup Beat: metricbeat; Version: 6.4.3

2018-11-28T17:43:31.514Z ERROR tlscommon/tls.go:63 Failed loading client certificate%!(EXTRA \*errors.errorString=tls: failed to parse private key)

2018-11-28T17:43:31.514Z INFO instance/beat.go:340 metricbeat stopped.

2018-11-28T17:43:31.538Z ERROR instance/beat.go:764 Exiting: error initializing publisher: 1 error: tls: failed to parse private key

config:

#-------------------------- Elasticsearch output ------------------------------

output.elasticsearch:

# Array of hosts to connect to.

hosts: [“hostname:9200”]

# Optional protocol and basic auth credentials.

protocol: “https”

#username: “admin”

#password: “admin”

#ssl.verification\_mode: none

ssl.certificate\_authorities: [“/etc/metricbeat/root-ca.pem”]

ssl.certificate: “/etc/metricbeat/dev-test.pem”

ssl.key: “/etc/metricbeat/dev-test.key”

ssl.key\_passphrase: ‘xxxxxx’

When i try use user-password - all work fine.

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version

Search Guard and elasticsearch 6.4.3

- Installed and used enterprise modules, if any

No

- JVM version and operating system version

OpenJDK 1.8.0\_191, OS CentOS 7.5

- Search Guard configuration files

- Elasticsearch log messages on debug level

- Other installed Elasticsearch or Kibana plugins, if any

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [December 12, 2018, 8:13am UTC](https://forum.search-guard.com/t/how-to-configure-metricbeat-connect-to-elasticsearch-with-ssl/1223/2 "2018-12-12T08:13:16Z")

</div>

Seems like metricbeat (which is implemented in golang) does not like your /etc/metricbeat/dev-test.key keyfile.

Make sure the password given with “ssl.key\_passphrase” is correct.

How did you generate this? With OpenSSL? Then pls look here: [Filebeat private key parse error - #5 by itspecialistsimon - Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/filebeat-private-key-parse-error/119633/5)

So it seems the private key is not in PKCS8 format. Maybe this helps:

> **[Tutorial for PKCS5 and PKCS8 PEM private key formats differences](https://github.com/kjur/jsrsasign/wiki/Tutorial-for-PKCS5-and-PKCS8-PEM-private-key-formats-differences)**
>
> The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 cert...

As this is not a directly Search Guard related issue you may want to ask your question also here: [https://discuss.elastic.co/](https://discuss.elastic.co/)

> **···**
>
> On Wednesday, 28 November 2018 18:49:28 UTC+1, Konstantin Fetisov wrote:
> 
> > I try configure metricbeat to ssl connect, but when start metricbeat i have this error:
> 
> > 
> 
> > 2018-11-28T17:43:31.512Z INFO instance/beat.go:286 Setup Beat: metricbeat; Version: 6.4.3
> 
> > 2018-11-28T17:43:31.514Z ERROR tlscommon/tls.go:63 Failed loading client certificate%!(EXTRA \*errors.errorString=tls: failed to parse private key)
> 
> > 2018-11-28T17:43:31.514Z INFO instance/beat.go:340 metricbeat stopped.
> 
> > 2018-11-28T17:43:31.538Z ERROR instance/beat.go:764 Exiting: error initializing publisher: 1 error: tls: failed to parse private key
> 
> > 
> 
> > config:
> 
> > #-------------------------- Elasticsearch output ------------------------------
> 
> > output.elasticsearch:
> 
> > # Array of hosts to connect to.
> 
> > hosts: [“hostname:9200”]
> 
> > 
> 
> > # Optional protocol and basic auth credentials.
> 
> > protocol: “https”
> 
> > #username: “admin”
> 
> > #password: “admin”
> 
> > #ssl.verification\_mode: none
> 
> > ssl.certificate\_authorities: [“/etc/metricbeat/root-ca.pem”]
> 
> > ssl.certificate: “/etc/metricbeat/dev-test.pem”
> 
> > ssl.key: “/etc/metricbeat/dev-test.key”
> 
> > ssl.key\_passphrase: ‘xxxxxx’
> 
> > 
> 
> > When i try use user-password - all work fine.
> 
> > 
> 
> > When asking questions, please provide the following information:
> > 
> > - Search Guard and Elasticsearch version
> 
> > Search Guard and elasticsearch 6.4.3
> 
> > - Installed and used enterprise modules, if any
> 
> > No
> 
> > - JVM version and operating system version
> 
> > OpenJDK 1.8.0\_191, OS CentOS 7.5
> 
> > - Search Guard configuration files
> 
> > - Elasticsearch log messages on debug level
> 
> > 
> 
> > - Other installed Elasticsearch or Kibana plugins, if any