Error in shipping logs between different servers using ELK and Filebeat

Question

I have installed Filebeat deb package in Client-server(Linux Wind-River) and ELK in Elk-server(Ubuntu-16.04-server). The problem is, I can't receive logs from Client-server. I checked the network statistics and it seems 5044 port(Listening port) in ELK server is LISTENING. I can ping from both sides. I also have ssh connection in both directions.

This is the link which I used to install these packages on servers.

My Filebeat configurations:

filebeat.prospectors:
- type: log
# Change to true to enable this prospector configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.  paths:
   - /var/log/filebeat/*
   - /var/log/*.log  
  #- c:\programdata\elasticsearch\logs\*
document_type: log
#============================= Filebeat modules =============================== 
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading  
reload.enabled: false
#==================== Elasticsearch template setting ==========================
setup.template.settings:
index.number_of_shards: 3
#----------------------------- Logstash output -------------------------------- 
output.logstash:
# The Logstash hosts
hosts: ["192.168.10.3:5044"]
proxy_url: socks5://wwproxy.seln.ete.ericsson.se:808
# Optional SSL. By default is off. 
# List of root certificates for HTTPS server verifications
ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
# Certificate for SSL client authentication
ssl.certificate: "/etc/pki/tls/certs/logstash-forwarder.crt"
# Client Certificate Key
ssl.key: "/etc/pki/tls/private/logstash-forwarder.key"

Hopefully that's what the configuration looks like. If not, please fix it (and format it properly) — James Z
@JamesZ I checked the filebeat configuration in Client-server and it says "Configuration ok!" But I can't solve the issue. — Vamshi Krishna
Well I was talking about re-formatting your configuration dump here that was totally unreadable — James Z
Thanx for your comments and your valuable time Mr.@JamesZ! I configured the error which is in certificate generated between the Client-Server and ELK server. — Vamshi Krishna

Vamshi Krishna Vamshi Krishna · Accepted Answer · 2018-04-10T11:38:20

I figured out the Error! The problem is the server IP in openssl.cnf should be the IP address of bridged Interface. And the certificate generated with this openssl.cnf should be used in both the servers. Further, I also shared the .key generated in ELK server to Client-server to be more secured/authenticate.

Error in shipping logs between different servers using ELK and Filebeat

1 Answers