Streams and Logstash input plugins

Help
,
1

I cannot get the Stream to work with logstash (v7.17 or v8.5).
My logstash input is
http {
type => “auth0”
port => 9090
ssl => true
ssl_certificate => “/etc/ssl/certs/wc.tli.com.pem”
ssl_key => “/etc/ssl/private/wc.tli.com.key”
codec => “json”
tags => [“auth0”]
}
Verified this works fine by successfully accessing https://www.redacted.com:9090, get a simple page that says OK. The cert installed is a wildcard cert that matches the FQDN used so there are no cert errors.
In the Webhook Stream setup, the only value configured is Payload URL with https://www.redacted.com:9090.
I run a tcpdump on the logstash server. I see the following.
syn from auth0
syn-ack from logstash
ack from logstash
ack from logstash
fin from logstash
fin ack from auth0
The only (unhelpful) message in Auth0 is Error “message”: “Could not reach endpoint”.
To me, logstash is clearly being reached, is responding with an ack, but never receives further communication from auth0 so logstash closes the tcp session.

I started with a username and password on the http listener, same story. Now I am no authentication.
At this point I have no useful logs to troubleshoot with, nor can I find anything from others having the same problem. Any ideas?

2

Was this ever figured out? Seeing the same issue

3

Update for anyone here. You need to have the full chain of certs for your TLS certs on your webhook for the auth0 stream to work.