Logstash to Logstash communication (http output plugin to http input plugin)

[sakshisaxena]

I am trying to send logs from one logstash instance to another instance using http output plugin and http input plugin.
I am able to to it with following configuration:

(Sending Instance) output { http { url => "http://x.x.x.x:5044" http_method => "post" } }
(Receiving Instance) input { http { id => "my_plugin_id" host => "0.0.0.0" port => 5044 } }

But when I try to setup 1-way SSL for the above communication with the following configuration:

output { http { url => "https://x.x.x.x:5044" http_method => "post" cacert => "/**/ca_cert.pem" } }

or
output { http { url => "https://x.x.x.x:5044" http_method => "post" truststore => "//truststore.jks" truststore_password => "*" } }

ca_cert.pem is the CA used to sign the certificate for the receiving instance

input { http { id => "my_plugin_id" host => "0.0.0.0" port => 5044 ssl => true keystore => "//truststore.jks" keystore_password => "*" } }

Error received-> Could not fetch URL {:url=>"https://x.x.x.x:5044", ---- :headers=>{"Content-Type"=>"application/json"}, :message=>"SSL peer shut down incorrectly", :class=>"Manticore::ClientProtocolException", :backtrace=>nil, :will_retry=>true}

Looks like the configuration in http output plugin is not taking effect ( cacert, truststore, truststore_password).

• Version: 6.2.4

[jsvd]

can you confirm your certificates work correctly at the tcp+tls level?

For example, you can use openssl to validate:

1. the server tls setup through s_client:

openssl s_client -connect ip:port -CAfile /path/to/ca-certificates.crt

2. the client tls setup through s_server:

openssl s_server -key key.pem -cert cert.pem -accept port

I have tried this locally with http input + http output both using certificates and it worked correctly.

[sakshisaxena]

Hi,

Thanks for your reply.

Can you please share the http input plugin configurations?
I verified the certificates with openssl, they are working correctly but I guess I am not configuring them correctly in the http input + output plugin.