CA Certificate Path Incorrect

The collector's log indicates that the certificate file path for an output is incorrect with an error including file_if_set validation.

SYMPTOM

The collector's log indicates a message similar to the following:

{"level":"panic","ts":"2023-08-25T11:34:48.953Z","logger":"flowcoll","caller":"elasticsearch/instance_registration.go:33","msg":"failed to instantiate config","code":"elasticsearch/conf-error","reason":"ENV: 'EF_OUTPUT_ELASTICSEARCH_TLS_CA_CERT_FILEPATH' Value: '/root/http_ca.crt' Error: failed 'file_if_set' validation"

Note the message Error: failed 'file_if_set' validation.

PROBLEM

The collector cannot find a file at the path specified for the output. For Elasticsearch this would be EF_OUTPUT_ELASTICSEARCH_TLS_CA_CERT_FILEPATH. If this setting is not blank, it must be set to a valid certificate file or the collector will not run.

SOLUTION

You must do ONE of the following:

• Set EF_OUTPUT_<output name>_TLS_CA_CERT_FILEPATH to the full path of a valid certificate file.

• Set EF_OUTPUT_<output name>_TLS_SKIP_VERIFICATION to true

REFERENCE

• Cribl Output

  • EF_OUTPUT_CRIBL_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_CRIBL_TLS_SKIP_VERIFICATION

• Elasticsearch Output

  • EF_OUTPUT_ELASTICSEARCH_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_ELASTICSEARCH_TLS_SKIP_VERIFICATION

• Generic HTTP Output

  • EF_OUTPUT_GENERIC_HTTP_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_GENERIC_HTTP_TLS_SKIP_VERIFICATION

• Kafka Output

  • EF_OUTPUT_KAFKA_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_KAFKA_TLS_SKIP_VERIFICATION

• OpenSearch Output

  • EF_OUTPUT_OPENSEARCH_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_OPENSEARCH_TLS_SKIP_VERIFICATION

• Splunk HEC Output

  • EF_OUTPUT_SPLUNK_HEC_TLS_CA_CERT_FILEPATH

  • EF_OUTPUT_SPLUNK_HEC_TLS_SKIP_VERIFICATION