jmeher
January 21, 2025, 5:14am
1
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch - 2.18.0
Describe the issue :
How to configure the certificate for input source & output destination for OpenSearch Logstash. Below configuration is not working for me.
Configuration :
input {
opensearch {
hosts => [“https://HOST1:9200 ”]
index => “my_source_index”
query => ‘{ “query”: { “match_all”: {}} }’
ssl_certificate_authorities => [“/user/certificate_src/CA.pem”]
ssl_certificate => “/user/certificates_src/client.pem”
ssl_key => “/user/certificate_src/client.key”
ssl => true
}
}
output {
opensearch {
hosts => [“https://HOST2:9200 ”]
index => “my_dest_index”
ecs_compatibility => “disabled”
ssl_certificate_authorities => [“/user/certificate_dest/CA.pem”]
ssl_certificate => “/user/certificate_dest/client.pem”
ssl_key => “/user/certificate_dest/client.key”
ssl => true
}
}
Relevant Logs or Screenshots :
pablo
January 21, 2025, 11:29am
2
@jmeher As per “Logstash OpenSearch input plugin” code you have two options.
Set ssl to true (ssl => true). This will disable SSL certificate verification.
Set ssl and ca_file (ssl => true, ca_file => “path to OpenSearch node root-ca.pem file”). This will enable SSL verification.
There is no client certificate authentication for the input plugin.
end
def search_request(options)
@client.search(options)
end
def hosts_default?(hosts)
hosts.nil? || ( hosts.is_a?(Array) && hosts.empty? )
end
def setup_ssl
return { :ssl => true, :ca_file => @ca_file } if @ssl && @ca_file
return { :ssl => true, :verify => false } if @ssl # Setting verify as false if ca_file is not provided
end
def setup_hosts
@hosts = Array(@hosts).map { |host| host.to_s } # potential SafeURI#to_s
if @ssl
@hosts.map do |h|
host, port = h.split(":")
{ :host => host, :scheme => 'https', :port => port }