The Logstash ES output (elasticsearch-output.conf.j2) bundles keystore (client cert), cacert (server verification) and user/password (auth) under one flag — and the keystore is shipped even though ES does not request a client cert, so it is ignored today.
Separate the concerns: cacert / ssl_certificate_authorities (the client verifying the ES server — needed for any TLS, docs) stays on the TLS axis; the keystore / ssl_keystore_path (Logstash's own client certificate) becomes an opt-in mTLS flag.
Depends on: the ES-side enabler xpack.security.http.ssl.client_authentication (#536) and the Logstash TLS axis logstash_tls (#529). Overlaps #529 — both restructure the same ES-output block, so coordinate. Opt-in, default off. Part of #536. 2.0.0.
The Logstash ES output (
elasticsearch-output.conf.j2) bundleskeystore(client cert),cacert(server verification) anduser/password(auth) under one flag — and thekeystoreis shipped even though ES does not request a client cert, so it is ignored today.Separate the concerns:
cacert/ssl_certificate_authorities(the client verifying the ES server — needed for any TLS, docs) stays on the TLS axis; thekeystore/ssl_keystore_path(Logstash's own client certificate) becomes an opt-in mTLS flag.Depends on: the ES-side enabler
xpack.security.http.ssl.client_authentication(#536) and the Logstash TLS axislogstash_tls(#529). Overlaps #529 — both restructure the same ES-output block, so coordinate. Opt-in, default off. Part of #536. 2.0.0.