Skip to content

Securing Filebeat


Hint - TLS encryption

For security reasons, we strongly recommend configuring the TLS encryption.


Configuring the TLS Encryption

The SEAL Elastic Stack installation includes a self-signed TLS certificate. Replace this certificate by your own certificate to secure the connection to Filebeat.

  1. Get your own TLS certificate:

    • cert.pem

    • key.pem

  2. Copy your TLS certificate to the following directory:

    /opt/seal/etc/tls-external
    

    Hint - changing the TLS directory

    We recommend you use a directory different from tls for your customer certificates, e. g. tls-external.

    This allows you to easily switch back to the included certificates for test purposes.

    Also it prevents your certificates from being overwritten during an update.

    Make sure you use the new directory in all SEAL products that use TLS encryption.


Configuring the TLS Encryption in a Cluster

If you run PLOSSYS 5 in a cluster, replace the TLS certificate as described above on each PLOSSYS 5 server separately.


Specifying a CA Certificate

If a CA certificate has been specified, Filebeat requires a client certificate from each client. This requires corresponding properties of the certificate.

Configure a CA certificate as follows:

  1. On the PLOSSYS 5 server, open the Filebeat configuration file:

    /opt/seal/etc/filebeat.yml
    
  2. Replace the line:

    insecure: true
    

    by the follwing line:

    certificate_authorities: ["/opt/seal/etc/tls/ca.pem"]
    
  3. Save the configuration file.

  4. Restart Filebeat:

    sudo systemctl restart seal-filebeat
    

Back to top