Logstash behind reverse proxy

Viewed 1591

I am trying to send logs from Filebeat to Logstash trought Nginx. I have each Elasticsearch and Logstash behind nginx reverse proxy which they are on same server. When I send logs from Filebeat directly to the Elasticsearch proxy it works fine, however when I try send them to the Logstash nothing happend and no errors are generated.

Log goes: Filebeat -> NGINX_PROXY_FQDN -> ES_SERVER_FQDN:5044 -> ES_SERVER_FQDN:9200

Filebeat.yml

output.logstash:
  hosts: ["NGINX_PROXY_FQDN:443"]
  protocol: https
  ssl.certificate: "/etc/filebeat/certs/nginxproxy.crt"
  ssl.key: "/etc/filebeat/certs/nginxproxy.key"
  ssl.certificate_authorities: /etc/filebeat/certs/ca.pem

Nginx, Logstash reverse proxy

server {
        listen 443;
        listen [::]:443;

        ssl on;
        ssl_certificate     certs/nginxproxy.crt;
        ssl_certificate_key certs/nginxproxy.key;
        ssl_trusted_certificate certs/ca.pem;

        ssl_session_cache  builtin:1000  shared:SSL:10m;
        ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
        ssl_prefer_server_ciphers on;

        server_name NGINX_PROXY_FQDN;

        location / {
        proxy_pass https://ES_SERVER_FQDN:5044;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Proxy-Connection "upgrade";
        proxy_set_header Host $host;
        }
}

Logstash.conf

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/logstash/certs/nginxproxy.crt"
    ssl_key => "/etc/logstash/certs/nginxproxy.key"
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.pem"]
    ssl_verify_mode => "force_peer"
 }
}
output {
  elasticsearch {
   hosts => ["https://ES_SERVER_FQDN:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user => "*****"
    password => "*****"
    ssl => true
    cacert => "/etc/logstash/certs/ca.pem"
    ilm_enabled => false
 }
}
0 Answers
Related