Logstash elasticsearch https output filter

Question

Using a logstash 2.2 docker container to send local application log data to an AWS Elasticsearch v5.1 cluster and wanting this traffic to use HTTPS but failing.

I have tried the following entries in my /etc/logstash/conf.d/logstash.conf file:

output {
  elasticsearch {
    hosts => "https://my-aws-es-domain.es.amazonaws.com:443"
  }
}

as well as:

hosts => "https://my-aws-es-domain.es.amazonaws.com"
hosts => "my-aws-es-domain.es.amazonaws.com:443"

The error message that I am seeing in the logstash logs is:

message=\u003e\"my-aws-es-domain.es.amazonaws.com:443 failed to respond\"

If I use http and port 80 it works without error.

Can anyone advise on the proper values to send the log data via HTTPS to ES?

Kulasangar Kulasangar · Accepted Answer · 2017-02-23T18:22:06

My guess is that you're missing out the ssl synopsis in your elasticsearch output:

output {
  elasticsearch {
    hosts => "https://my-aws-es-domain.es.amazonaws.com:443"
    ssl   => true
  }
}

Quoting from the doc:

If SSL is explicitly disabled here the plugin will refuse to start if an HTTPS URL is given in hosts

Hope this helps!

Logstash elasticsearch https output filter

1 Answers