Logstash 輸出到 Elasticsearch SSL 證書

Question

我有以下碼頭集裝箱

docker create \
--name=elasticsearch \
--restart=always \
--network=infrastructure_network \
--network-alias=elasticsearch \
-e TZ=Etc/UTC \
-e discovery.type=single-node \
-e "ES_JAVA_OPTS=-Xms6g -Xmx6g" \
-e ELASTIC_PASSWORD="foobar" \
-p 9200:9200 \
-p 9300:9300 \
-v elasticsearch:/usr/share/elasticsearch \
elasticsearch:8.0.0

docker create \
--name=logstash \
--restart=always \
--network=infrastructure_network \
--network-alias=logstash \
-e TZ=Etc/UTC \
-p 5040:5040 \
-p 8514:8514/udp \
-v logstash:/usr/share/logstash/ \
-v elasticsearch:/elastic/ \
logstash:8.0.0

容器啟動非常好，但是..當我設置logstash輸出如下：

input 
{
  tcp 
  {
    port => 8514
    type => syslog
  }
}

filter 
{
  if [type] == "syslog" 
  {
    grok 
    {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    date 
    {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss.SSS", "MMM dd HH:mm:ss.SSS" ]
      timezone => "UTC"
    }
  }
}

output 
{
    elasticsearch 
    {
        hosts => ['https://elasticsearch:9200']
        cacert => '/elastic/config/certs/http_ca.crt'
        ssl_certificate_verification => false
        user => "elastic"
        password => "foobar"
        index => "syslog"
        ilm_enabled => false
    }

    stdout { codec => rubydebug }
}

我在 logstash 日志中收到以下錯誤...

原因：sun.security.validator.ValidatorException：PKIX 路徑構建失敗：sun.security.provider.certpath.SunCertPathBuilderException：無法找到請求目標的有效證書路徑

[2022-03-02T03:27:04,496][WARN][logstash.outputs.elasticsearch][main] 嘗試重新連接到死掉的 ES 實例，但出現錯誤 {:url=>"https://elastic:xxxxxx @elasticsearch:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch 無法訪問：[https://elasticsearch:9200/][Manticore:: ClientProtocolException] PKIX 路徑構建失敗：sun.security.provider.certpath.SunCertPathBuilderException：無法找到請求目標的有效證書路徑"}

[2022-03-02T03:27:08,344][DEBUG][logstash.outputs.elasticsearch][main] 等待連接到 Elasticsearch 集群，16 秒后重試

我假設我可能使用了錯誤的證書？ 這是 elascticsearch 容器啟動時創建的證書，我應該使用什么？

Answer 1

添加ssl => true以輸出彈性