FreeBSD/jails/config/elk/logstash.conf

# Copyright (c) 2018-2021, diyIT.org
# All rights reserved.
#
# BSD 2-Clause License ("Simplified BSD License" or "FreeBSD License")
# https://diyit.org/license/
#
#

input {
  beats {
    port => 5044
    ssl => false
    #https://discuss.elastic.co/t/problem-with-cipher-in-beat-input/67841
    ssl_key => '/mnt/certs/diyprivkeyr.pem'
    ssl_certificate => '/mnt/certs/diyfullchain.pem'
    ssl_certificate_authorities => ["/mnt/certs/cacert.pem"]
    ssl_verify_mode => "force_peer"
  }
}

output {
  elasticsearch {
    ssl => true
    ssl_certificate_verification => true
    cacert => '/mnt/certs/cacert.pem'
    hosts => ["https://elk.diyit.org:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "${es_pwd}"
  }
}