How to enable SSL/TLS in Filebeat

Securing Filebeat output with TLS encrypts data in transit. Whether sending to Elasticsearch or Logstash, TLS ensures confidentiality and integrity of logs.

Filebeat allows specifying CA certificates, client certificates, and keys. With proper trust established, data flows securely end-to-end.

Enabling TLS aligns with security best practices, guarding against interception and tampering.

1. Obtain the CA certificate or server certificate to trust.
2. Place the certificate files in a secure directory with correct permissions.

   Use full paths in filebeat.yml to reference these certificates.

3. Edit filebeat.yml and configure output.elasticsearch or output.logstash to use ssl.certificate_authorities.

   $ sudo nano /etc/filebeat/filebeat.yml
   (no direct output)

   Set ssl.verification_mode: full for strict certificate checks.

4. Test the configuration.

   $ sudo filebeat test config
   Config OK

   Certificate mismatches or expired certs cause connection failures.

5. Restart Filebeat.

   $ sudo systemctl restart filebeat
   (no output)

   Check destination logs to confirm secure, encrypted communication.