Configure LogStash Keystore

[#1]

When you configure Logstash, you might need to specify sensitive settings or configuration, such as passwords. Rather than relying on file system permissions to protect these values, you can use the Logstash keystore to securely store secret values for use in configuration file. In such a scenario, you should incorporate the decoder password into the Logstash Keystore.

Run the following commands to create the Logstash Keystore.

1. vi /etc/sysconfig/logstash

   # Add environment variable to the /etc/sysconfig/logstash file. For example, the expected format of /etc/sysconfig/logstash is LOGSTASH_KEYSTORE_PASS=<keystorepassword>, with one entry per line.

2. chmod 600 /etc/sysconfig/logstash

3. source /etc/sysconfig/logstash

4. systemctl restart logstash.service

5. set +o history

6. export LOGSTASH_KEYSTORE_PASS=<keystorepassword>

   # Replace <keystorepassword> with the password set in /etc/sysconfig/logstash

7. set -o history

8. sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create

9. sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash add KEY

   # Give decoder password during the addition of the KEY

   # Make sure that the key got generated by running the following command

10. sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash list

For more information on LogStash keystore, refer Secret Keystore for Secure Settings.