search

elastic / logstash

Logstash - transport and process your logs, events, or other data
https://www.elastic.co/products/logstash
Other
69 stars 3.5k forks source link

Inconsistent elasticsearch settings between modules and metrics/monitoring #9441

Open elasticmachine opened 7 years ago

elasticmachine commented 7 years ago

Original comment by @robbavey:

The settings for elasticsearch properties for modules and metrics/configuration management is inconsistent, particularly with regard to how security is handled:

Property Module Key Metric Key
Elasticsearch Hosts var.elasticsearch.hosts xpack.monitoring.elasticsearch.url
Certificate Authority var.elasticsearch.ssl.certificate_authority xpack.monitoring.elasticsearch.ssl.ca
Turn off host verification var.elasticsearch.ssl.verification_mode xpack.monitoring.elasticsearch.ssl.verification_mode
SSL Enabled var.elasticsearch.ssl.enabled NOT EXPLICITLY ENABLED
Path to certificate for client auth var.elasticsearch.ssl.certificate NO SETTING
Path to key for client auth var.elasticsearch.ssl.key NO SETTING
Path to Truststore NO SETTING xpack.monitoring.elasticsearch.ssl.truststore.path
Truststore Password NO SETTING xpack.monitoring.elasticsearch.ssl.truststore.password
Client certificate keystore NO SETTING xpack.monitoring.elasticsearch.ssl.keystore.path
Client certificate password NO_SETTING xpack.monitoring.elasticsearch.ssl.keystore.password
elasticmachine commented 7 years ago

Original comment by @jsvd:

I think the main cause for this is that we aligned the modules settings with beats' modules, and the x-pack settings with x-pack settings on other products.

elasticmachine commented 7 years ago

Original comment by @robbavey:

cc @acchen97 @andrewvc

elasticmachine commented 7 years ago

Original comment by @andrewvc:

Hmmm, this is the sort of thing that's really hard to align. Your thoughts @acchen97 ?

I'm not sure what matters more, internal consistency, or consistency between families of products.

elasticmachine commented 6 years ago

Original comment by @ycombinator:

Related question on discuss: https://discuss.elastic.co/t/configuring-both-x-pack-monitoring-and-x-pack-management-with-tls-for-logstash/126045

My PEM certificate does not contain the hostname. Is there a way for Logstash/X-Pack not to do full hostname verification for Monitoring and Centralized Pipeline Management? It is weird that Elasticsearch and Kibana are able to do that, but not Logstash.

gmoskovicz commented 6 years ago

Something to add here is that as an example var.elasticsearch.ssl.certificate_authority has strict/disable values, while xpack.monitoring.elasticsearch.ssl.verification_modehas none, certificate, and full and from https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ssl_certificate_verification it is a boolean type.

Might be a good idea to unify the criteria for this.