Document how to use TLS/SSL settings with modules

[karenzone]

From @andrewvc: "I've seen some credible user reports that HTTPS just isn't working with ES/Kibana + modules. We should try to replicate and patch if needed." (Issue: #9269 )

From @tsg: "While I think everything works as expected, it does seem like this is more complex to get right than it should be. @guyboertje @karenzone Perhaps it would make sense to have a documentation setting on using modules with a TLS enabled ES/KB setup?"

Possible location for info: https://www.elastic.co/guide/en/logstash/current/logstash-modules.html

[karenzone]

Current TLS/SSL info in Elastic doc:

• https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html references
• https://www.elastic.co/guide/en/logstash/6.2/ls-security.html

Q: Are we providing adequate information that people aren't finding?
Q: What information are we not providing?
Q: Are there issues specific to TLS/SSL and Logstash modules that we haven't documented?

As we open X-Pack, we're looking to provide a more comprehensive (rather than piecemeal) approach to security. Let's keep that goal in mind while we resolve this issue .

[tsg]

Sorry for the delay, from what I see the two docs pages refer to instructions on how to use the Elasticsearch output in Logstash with TLS enabled. That part is pretty good documented.

What I didn't find in the docs is the SSL/TLS options that exposed by the modules. These are, at least:

 var.elasticsearch.ssl.enabled 
 var.elasticsearch.ssl.certificate_authority
 var.kibana.ssl.enabled
 var.kibana.ssl.certificate_authority

We should document these, reference style, probably in https://www.elastic.co/guide/en/logstash/current/logstash-modules.html#setting-logstash-module-config. Providing the example from #9269 (comment) is also going to be of great help.

@guyboertje It would be great if you could add a first draft reference docs for the above, and for other SSL options that are supported. I'd also like to discuss if we could make the ssl.enabled flags implicit if any other ssl.* options are set (this is what we do in Beats).