
检查ES日志,发现输出:

在检查ES配置文件,发现配置了启用了安全认证和 HTTPS:
cluster.name: es
node.name: node-1
network.host: 0.0.0.0
http.port: 9200
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12
xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["node-1"]
http.host: 0.0.0.0
那么就需要在Logstash配置要点包括:正确的hosts URL(https)、认证信息、SSL证书配置
于是需要在logstash启动的配置config里添加,这里我使用es第一次启动生成的账号(第一次启动会有fingerprint,同样需要添加),第一次启动生成如下:

output {
elasticsearch {
hosts => ["localhost:9200"]
user => "elastic"
password => "R-..."
ssl_enabled => true
ssl_verification_mode => full
ca_trusted_fingerprint => "cfe3b6d41b82b..."
index => "app-logs2-%{+YYYY.MM.dd}"
}
}