Securing Communication With Logstash by Using TLS

certificate_authorities: Configures Packetbeat to trust any certificates signed by the specified CA. If certificate_authorities is empty or not set, the trusted certificate authorities of the host system are used.

Although intermediate CAs are currently not supported, you may be able to work around this issue by merging all the certificates in the chain into one file. You can create the PEM file containing the CA chain by concatenating the root CA cert and the intermediate CA into a single file: cat root-ca.crt intermediate-ca.crt > chain.crt. Then set certificate_authorities to use this file: certificate_authorities: ['chain.crt'].

certificate and certificate_key: Specifies the certificate and key that Packetbeat uses to authenticate with Logstash.

For example:

output:
  logstash:
    hosts: ["logs.mycompany.com:5044"]
    tls:
      certificate_authorities: ["/etc/ca.crt"]
      certificate: "/etc/client.crt"
      certificate_key: "/etc/client.key"

For more information about these configuration options, see TLS Options.

ssl_verify_mode: Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either peer or force_peer to make the server ask for the certificate and validate it. If you specify force_peer, and Packetbeat doesn’t provide a certificate, the Logstash connection will be closed.

For example:

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/etc/ca.crt"]
    ssl_certificate => "/etc/server.crt"
    ssl_key => "/etc/server.key"
    ssl_verify_mode => "force_peer"
  }
}

For more information about these options, see the documentation for the Beats input plugin.