Secure communication with Logstashedit

This documentation refers to configuring the standalone (legacy) APM Server. This method of running APM Server will be deprecated and removed in a future release. Please consider upgrading to Fleet and the APM integration.

You can use SSL mutual authentication to secure connections between APM Server and Logstash. This ensures that APM Server sends encrypted data to trusted Logstash servers only, and that the Logstash server receives data from trusted APM Server clients only.

To use SSL mutual authentication:

  1. Create a certificate authority (CA) and use it to sign the certificates that you plan to use for APM Server and Logstash. Creating a correct SSL/TLS infrastructure is outside the scope of this document. There are many online resources available that describe how to create certificates.

    If you are using security features, you can use the elasticsearch-certutil tool to generate certificates.

  2. Configure APM Server to use SSL. In the apm-server.yml config file, specify the following settings under ssl:

    • certificate_authorities: Configures APM Server to trust any certificates signed by the specified CA. If certificate_authorities is empty or not set, the trusted certificate authorities of the host system are used.
    • certificate and key: Specifies the certificate and key that APM Server uses to authenticate with Logstash.

      For example:

        hosts: [""]
        ssl.certificate_authorities: ["/etc/ca.crt"]
        ssl.certificate: "/etc/client.crt"
        ssl.key: "/etc/client.key"

      For more information about these configuration options, see SSL output settings.

  3. Configure Logstash to use SSL. In the Logstash config file, specify the following settings for the Beats input plugin for Logstash:

    • ssl: When set to true, enables Logstash to use SSL/TLS.
    • ssl_certificate_authorities: Configures Logstash to trust any certificates signed by the specified CA.
    • ssl_certificate and ssl_key: Specify the certificate and key that Logstash uses to authenticate with the client.
    • ssl_verify_mode: Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either peer or force_peer to make the server ask for the certificate and validate it. If you specify force_peer, and APM Server doesn’t provide a certificate, the Logstash connection will be closed. If you choose not to use certutil, the certificates that you obtain must allow for both clientAuth and serverAuth if the extended key usage extension is present.

      For example:

      input {
        beats {
          port => 5044
          ssl => true
          ssl_certificate_authorities => ["/etc/ca.crt"]
          ssl_certificate => "/etc/server.crt"
          ssl_key => "/etc/server.key"
          ssl_verify_mode => "force_peer"

      For more information about these options, see the documentation for the Beats input plugin.

Validate the Logstash server’s certificateedit

Before running APM Server, you should validate the Logstash server’s certificate. You can use curl to validate the certificate even though the protocol used to communicate with Logstash is not based on HTTP. For example:

curl -v --cacert ca.crt

If the test is successful, you’ll receive an empty response error:

* Rebuilt URL to:
*   Trying
* Connected to ( port 5044 (#0)
* TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
* Server certificate:
> GET / HTTP/1.1
> Host:
> User-Agent: curl/7.43.0
> Accept: */*
* Empty reply from server
* Connection #0 to host left intact
curl: (52) Empty reply from server

The following example uses the IP address rather than the hostname to validate the certificate:

curl -v --cacert ca.crt

Validation for this test fails because the certificate is not valid for the specified IP address. It’s only valid for the, the hostname that appears in the Subject field of the certificate.

* Rebuilt URL to:
*   Trying
* Connected to ( port 5044 (#0)
* WARNING: using IP address, SNI is being disabled by the OS.
* SSL: certificate verification failed (result: 5)
* Closing connection 0
curl: (51) SSL: certificate verification failed (result: 5)

See the troubleshooting docs for info about resolving this issue.

Test the APM Server to Logstash connectionedit

If you have APM Server running as a service, first stop the service. Then test your setup by running APM Server in the foreground so you can quickly see any errors that occur:

apm-server -c apm-server.yml -e -v

Any errors will be printed to the console. See the troubleshooting docs for info about resolving common errors.