# Logstash -\> OpenSearch using certificate based authentication

**URL:** <https://forum.opensearch.org/t/logstash-opensearch-using-certificate-based-authentication/24491>\
**Category:** OpenSearch\
**Created:** [May 23, 2025, 4:20am UTC](https://forum.opensearch.org/t/logstash-opensearch-using-certificate-based-authentication/24491 "2025-05-23T04:20:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Evergreen1270](https://avatars.discourse-cdn.com/v4/letter/e/97f17d/32.png) [@Evergreen1270](https://forum.opensearch.org/u/Evergreen1270)\
**Post date:** [May 23, 2025, 4:20am UTC](https://forum.opensearch.org/t/logstash-opensearch-using-certificate-based-authentication/24491/1 "2025-05-23T04:20:41Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Using all the latest versions of OpenSearch, Dashboard and OSS Logstash.

**Describe the issue** :  
I am working to setup a OpenSearch cluster that uses client certificate authentication.  
This has been enabled in the OpenSearch nodes, and OpenSearch Dashboards successfully connects to the cluster using certificate based authentication.  
I am not trying to do the same with Logstash, but am unable to find the correct settings to specify the client certificate and key.  
Ideally, I do not want to have to supply a username and password, instead relying on certificate based auth to connect the two.

Can anyone help me with the correct settings or where to find the correct settings to successfully set this up?

**Configuration** :  
output {  
if [@metadata][index\_base] {  
opensearch {  
hosts =\> [“[https://opensearch-node01:9200](https://opensearch-node01:9200)”,“[https://opensearch-node02:9200](https://opensearch-node02:9200)”,“[https://opensearch-node03:9200](https://opensearch-node03:9200)”]  
ssl =\> true

```
		##ISSUE IS WITH THESE KEYS
		ssl_key => "/usr/share/logstash/config/certificates/logstash/logstash.key"
		ssl_certificate => "/usr/share/logstash/config/certificates/logstash/logstash.pem"

		#index => "logstash-%{[@metadata][index_base]}-%{+YYYY.MM}"
		index => "logstash-%{[@metadata][index_base]}"
		cacert => "/usr/share/logstash/config/certificates/ca/ca.pem"
		ssl_certificate_verification => true
	}
}

```

}

**Relevant Logs or Screenshots** :  
[2025-05-23T04:12:18,234][ERROR][logstash.outputs.opensearch] Unknown setting ‘ssl\_certificate’ for opensearch  
[2025-05-23T04:12:18,235][ERROR][logstash.outputs.opensearch] Unknown setting ‘ssl\_key’ for opensearch

---

<div class="post-metadata">

**Author:** ![Evergreen1270](https://avatars.discourse-cdn.com/v4/letter/e/97f17d/32.png) [@Evergreen1270](https://forum.opensearch.org/u/Evergreen1270)\
**Post date:** [May 23, 2025, 4:54am UTC](https://forum.opensearch.org/t/logstash-opensearch-using-certificate-based-authentication/24491/2 "2025-05-23T04:54:29Z")

</div>

I think I might have worked it out by using  
tls\_key =\> “/usr/share/logstash/config/certificates/logstash/logstash.key”  
tls\_certificate =\> “/usr/share/logstash/config/certificates/logstash/logstash.pem”

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 23, 2025, 11:00am UTC](https://forum.opensearch.org/t/logstash-opensearch-using-certificate-based-authentication/24491/3 "2025-05-23T11:00:01Z")

</div>

@Evergreen1270 Correct, tls\_key and tls\_certificate are valid settings for the OpenSearch output plugin.

Is Logstash working for you now? Does it ingest data?