title: Logstash HTTP output can't post to to HTTPS endpoint requiring client certificates
body: <p>I'm currently attempting to send some sample events from Logstash receiving servers on our production environment to a testing env via the http output.<br>
  The server on the receiving end is a custom Nginx HTTPS endpoint which accepts post data (endpoints for both single events, and bulk events to support Elasticsearch bulk indexing format) and places it into a redis queue, which is eventually read by Logstash processing servers.  </p>
  
  <p>The current http output on the logstash receiving server looks something like this:</p>
  
  <pre><code> http {
     url =&gt; "https://json-logs-endpoint.example.com:8443/event"
     http_method =&gt; "post"
     format =&gt; "json"
     ssl_certificate_validation =&gt; false
     client_cert =&gt; "/etc/filebeat/ssl/filebeat.crt"
     client_key =&gt; "/etc/filebeat/ssl/filebeat.key"
     cacert =&gt; "/etc/filebeat/ssl/filebeat.chain"
   }
  </code></pre>
  
  <p>The cert related options are using the same files as the filebeat log shipper (installed on all servers), via elasticsearch output.  The permissions on the files in <code>/etc/filebeat/ssl/</code> does allow logstash to read the certs. My filebeat config ressembles something like this:</p>
  
  <pre><code>filebeat:
    prospectors: []
    registry_file: "/var/lib/filebeat/registry"
    config_dir: "/etc/filebeat/conf.d"
  output:
    elasticsearch:
      enabled: true
      hosts:
      - json-logs-endpoint.example.com:8443
      protocol: https
      path: "/multi-event"
      tls:
        certificate_authorities:
        - "/etc/filebeat/ssl/filebeat.chain"
        certificate: "/etc/filebeat/ssl/filebeat.crt"
        certificate_key: "/etc/filebeat/ssl/filebeat.key"
  </code></pre>
  
  <p>All filebeat instances on all servers are successfully sending data via https to this Nginx server, via the <code>/multi-event</code> endpoint.</p>
  
  <p>The only difference between the <code>/event</code> and <code>/multi-event</code> endpoints are that the former accepts a single JSON event and the latter accepts data in the format of an <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html" rel="nofollow">elasticsearch bulk indexing request</a>.<br>
  Both endpoints are secured via SSL in the same fashion.  When Logstash is started, there's no indication of any error relating to the http output, although after a very short period of time pipeline essentially halts.  Running logstash in verbose mode then provides a bit more information, with <a href="http://pastebin.com/ZsFURE2M" rel="nofollow">this stack trace</a>.</p>
  
  <p>I'm guessing the problem is related to the format of the provided certs?  I would really appreciate if someone could point out my issue.</p>
  
  <p>Thanks!</p>