# Logstash with opensearch docker container **URL:** \ **Category:** Security\ **Tags:** troubleshoot, configure, install\ **Created:** [June 21, 2022, 4:57pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006 "2022-06-21T16:57:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [June 21, 2022, 4:57pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/1 "2022-06-21T16:57:28Z")
hello has anyone run logstash in docker container to connect opensearch as per docker-compose file > **[Docker](https://opensearch.org/docs/latest/opensearch/install/docker/#sample-docker-compose-file-for-development)** > > Docker the above starts network with config\_opensearch-net(file has opensearch-net) below starts but unable to connect also seen ssl\_certificate\_verification is required for opensearch and wont work with false on other forums and seen it my last run without logstash container but documentation has below reference with( ssl\_certificate\_verification =\> false) > **[Logstash](https://opensearch.org/docs/latest/clients/logstash/index/)** > > Logstash > docker run -it --rm --name logstash --net config\_opensearch-net opensearchproject/logstash-oss-with-opensearch-output-plugin:7.16.2 -e ‘input { stdin { } } output { > opensearch { > hosts =\> [“[https://localhost:9200](https://localhost:9200)”] > index =^C"opensearch-logstash-docker-%{+YYYY.MM.dd}" > user =\> “osadmin” > password =\> “xxxx!” > ssl =\> true > ssl\_certificate\_verification =\> false > } > }’ [2022-06-21T16:42:49,608][WARN][logstash.runner] SIGINT received. Shutting down. [2022-06-21T16:42:51,447][WARN][logstash.outputs.opensearch][main] Attempted to resurrect connection to dead OpenSearch instance, but got an error {:url=\>“[https://osadmin:xxxxxx@localhost:9200/](https://osadmin:xxxxxx@localhost:9200/)”, :exception=\>LogStash::Outputs::OpenSearch::HttpClient::Pool::HostUnreachableError, :message=\>“OpenSearch Unreachable: [[https://osadmin:xxxxxx@localhost:9200/](https://osadmin:xxxxxx@localhost:9200/)][Manticore::SocketException] Connect to localhost:9200 [localhost/127.0.0.1] failed: Connection refused (Connection refused)”} seen below on othe places to make it work , can someone confirm if logstash container needs these steps to update cert to make it connect echo -n | openssl s\_client -connect localhost:9200 | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ \> ./ca\_logstash.cer keytool -import -alias saelk -file ca\_logstash.cer -keystore /usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.65-3.b17.el7.x86\_64/lib/security/cacerts changeit (pass) ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [June 21, 2022, 5:56pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/2 "2022-06-21T17:56:40Z")
@infodata The mentioned OpenSearch docker-compose has a security plugin and demo certs disabled. As a result, the OpenSearch cluster runs on HTTP and is not secured. That’s why your logstash docker might not to work as it tries to authenticate against HTTPS. To run a secured cluster you either set the below options to **false** or comment them out. ```auto "DISABLE_INSTALL_DEMO_CONFIG=true" "DISABLE_SECURITY_PLUGIN=true" ``` Also, avoid using **localhost** in the host value. Use either FQDN/IP of the docker host or container name of the OpenSearch. The network of the logstash container has to be exactly the same as OpenSearch container. ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [June 21, 2022, 6:14pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/3 "2022-06-21T18:14:13Z")
@pablo my current opensearch dockercompose cluster is working on https to connect to it https works but not http the logstash is looking for cert need to import it ? Edit:updating localhost to ip worked and it is https:// updating hosts =\>[“[https://10.1.1.x](https://10.1.1.x)”] which file should have this “DISABLE\_INSTALL\_DEMO\_CONFIG=true” “DISABLE\_SECURITY\_PLUGIN=true” ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [June 21, 2022, 6:18pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/4 "2022-06-21T18:18:44Z")
@infodata You don’t need to define the cert if you use `ssl_certificate_verification => false`. I’ve just tested your example and it worked in my lab. But I used FQDN of my docker host instead of localhost as localhost failed to work. ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [June 21, 2022, 6:22pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/5 "2022-06-21T18:22:40Z")
> [@infodata](#): > > which file should have this > “DISABLE\_INSTALL\_DEMO\_CONFIG=true” > “DISABLE\_SECURITY\_PLUGIN=true” @infodata The one you mentioned in your first post. > **[Docker](https://opensearch.org/docs/latest/opensearch/install/docker/#sample-docker-compose-file-for-development)** > > Docker ---
**Author:** ![infodata](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@infodata](https://forum.opensearch.org/u/infodata)\ **Post date:** [June 21, 2022, 7:29pm UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/6 "2022-06-21T19:29:36Z")
# docker exec -it 216 bash bash-4.2$ id uid=1000(logstash) gid=1000(logstash) groups=1000(logstash) bash-4.2$ pwd /usr/share/logstash bash-4.2$ cd config bash-4.2$ ls jvm.options log4j2.properties logstash-opensearch-sample.conf logstash-sample.conf logstash.yml pipelines.yml startup.options # bash-4.2$ pwd /usr/share/logstash bash-4.2$ cd pipeline/ bash-4.2$ ls logstash.conf for the logstash container which file is used as default conf or all files with \*.conf in this folder are used ? is there a working reference docker compose for logstash ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [June 22, 2022, 10:15am UTC](https://forum.opensearch.org/t/logstash-with-opensearch-docker-container/10006/7 "2022-06-22T10:15:31Z")
@infodata This is a pure Logstash config question. I suggest following the documentation. > **[Logstash Configuration Files | Logstash Reference \[7.16\] | Elastic](https://www.elastic.co/guide/en/logstash/7.16/config-setting-files.html)**