Generated secured certificates and have copied locally to each service. I am new to ELK and Searchguard. Please help me with a logstash configuration file.
Error: Logstash is not able to connect to ES, Getting timeout error messages in logs.
**************************** Elasticsearch.yml ********** searchguard configuration *****************
searchguard.ssl.transport.pemcert_filepath: /path/to/fullchain
searchguard.ssl.transport.pemkey_filepath: /path/to/privkey
searchguard.ssl.transport.pemtrustedcas_filepath: /path/to/chain
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: /path/to/fullchain
searchguard.ssl.http.pemkey_filepath: path/to/privkey
searchguard.ssl.http.pemtrustedcas_filepath: /path/to/chain
searchguard.authcz.admin_dn:
- “CN=dashboard.companyname,O=Let’s Encrypt, C=US”
searchguard.restapi.roles_enabled: [“sg_all_access”]
searchguard.enterprise_modules_enabled: false
**************************** Kibana.yml ********** searchguard configuration *****************
elasticsearch.url: “https://localhost:9200”
server.ssl.enabled: true
server.ssl.certificate: /path/to/fullchain
server.ssl.key: /path/to/privatekey
*** *************** logstash.conf ********** Elasticsearch Output config ***********
output{
elasticsearch {
"ssl" => true
"ssl_certificate_verification" => true
"hosts" => ["localhost:9200"]
"sniffing" => false
"cacert" => “path/to/chain.pem”
"user" => logstash_user
"password" => password
"index" => "logstash-index1”
}
stdout { codec => json }
}