Doc: Use current Logstash SSL settings for auditbeat (#46457) (#46650)

(cherry picked from commit 49aa721)

Co-authored-by: Karen Metts <[email protected]>

Author: mergify[bot]

docs/reference/auditbeat/configuring-ssl-logstash.md

@@ -17,41 +17,41 @@ To use SSL mutual authentication:
     If you are using {{security-features}}, you can use the [elasticsearch-certutil tool](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md) to generate certificates.
     ::::
 
-2. Configure Auditbeat to use SSL. In the `auditbeat.yml` config file, specify the following settings under `ssl`:
+2. Configure Auditbeat to use SSL. In the `auditbeat.yml` config file, specify these settings under `ssl`:
 
-    * `certificate_authorities`: Configures Auditbeat to trust any certificates signed by the specified CA. If `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
-    * `certificate` and `key`: Specifies the certificate and key that Auditbeat uses to authenticate with Logstash.
+    * `certificate_authorities`. Configures Auditbeat to trust any certificates signed by the specified CA. If `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
+    * `certificate` and `key`. Specifies the certificate and key that Auditbeat uses to authenticate with Logstash.
 
         For example:
 
         ```yaml
         output.logstash:
-          hosts: ["logs.mycompany.com:5044"]
+          hosts: ["logs.example.com:5044"]
           ssl.certificate_authorities: ["/etc/ca.crt"]
           ssl.certificate: "/etc/client.crt"
           ssl.key: "/etc/client.key"
         ```
 
         For more information about these configuration options, see [SSL](/reference/auditbeat/configuration-ssl.md).
 
-3. Configure Logstash to use SSL. In the Logstash config file, specify the following settings for the [Beats input plugin for Logstash](logstash-docs-md://lsr/plugins-inputs-beats.md):
+3. Configure Logstash to use SSL. In the Logstash config file, specify these settings for the [Beats input plugin for Logstash](logstash-docs-md://lsr/plugins-inputs-beats.md):
 
-    * `ssl`: When set to true, enables Logstash to use SSL/TLS.
-    * `ssl_certificate_authorities`: Configures Logstash to trust any certificates signed by the specified CA.
-    * `ssl_certificate` and `ssl_key`: Specify the certificate and key that Logstash uses to authenticate with the client.
-    * `ssl_verify_mode`: Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either `peer` or `force_peer` to make the server ask for the certificate and validate it. If you specify `force_peer`, and Auditbeat doesn’t provide a certificate, the Logstash connection will be closed. If you choose not to use [certutil](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md), the certificates that you obtain must allow for both `clientAuth` and `serverAuth` if the extended key usage extension is present.
+    * `ssl`. When set to true, enables Logstash to use SSL/TLS.
+    * `ssl_certificate_authorities`. Configures Logstash to trust any certificates signed by the specified CA.
+    * `ssl_certificate` and `ssl_key`. Specify the certificate and key that Logstash uses to authenticate with the client.
+    * `ssl_client_authentication`. Specifies whether the Logstash server verifies the client certificate against the CA. You need to specify either `required` or `optional` to make the server ask for the certificate and validate it. If you specify `required`, and Auditbeat doesn’t provide a certificate, the Logstash connection will be closed. If you choose not to use [certutil](elasticsearch://reference/elasticsearch/command-line-tools/certutil.md), the certificates that you obtain must allow for both `clientAuth` and `serverAuth` if the extended key usage extension is present.
 
         For example:
 
         ```json
         input {
           beats {
             port => 5044
-            ssl => true
+            ssl_enabled => true
             ssl_certificate_authorities => ["/etc/ca.crt"]
             ssl_certificate => "/etc/server.crt"
             ssl_key => "/etc/server.key"
-            ssl_verify_mode => "force_peer"
+            ssl_client_authentication => "required"
           }
         }
         ```
@@ -65,35 +65,35 @@ To use SSL mutual authentication:
 Before running Auditbeat, you should validate the Logstash server’s certificate. You can use `curl` to validate the certificate even though the protocol used to communicate with Logstash is not based on HTTP. For example:
 
 ```shell
-curl -v --cacert ca.crt https://logs.mycompany.com:5044
+curl -v --cacert ca.crt https://logs.example.com:5044 
 ```
 
 If the test is successful, you’ll receive an empty response error:
 
 ```shell
-* Rebuilt URL to: https://logs.mycompany.com:5044/
+* Rebuilt URL to: https://logs.example.com:5044/
 *   Trying 192.168.99.100...
-* Connected to logs.mycompany.com (192.168.99.100) port 5044 (#0)
-* TLS 1.2 connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
-* Server certificate: logs.mycompany.com
-* Server certificate: mycompany.com
+* Connected to logs.example.com (192.168.99.100) port 5044 (#0)
+* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
+* Server certificate: logs.example.com
+* Server certificate: example.com
 > GET / HTTP/1.1
-> Host: logs.mycompany.com:5044
+> Host: logs.example.com:5044
 > User-Agent: curl/7.43.0
 > Accept: */*
 >
 * Empty reply from server
-* Connection #0 to host logs.mycompany.com left intact
+* Connection #0 to host logs.example.com left intact
 curl: (52) Empty reply from server
 ```
 
-The following example uses the IP address rather than the hostname to validate the certificate:
+This example uses the IP address rather than the hostname to validate the certificate:
 
 ```shell
 curl -v --cacert ca.crt https://192.168.99.100:5044
 ```
 
-Validation for this test fails because the certificate is not valid for the specified IP address. It’s only valid for the `logs.mycompany.com`, the hostname that appears in the Subject field of the certificate.
+Validation for this test fails because the certificate is not valid for the specified IP address. It’s only valid for the `logs.example.com`, the hostname that appears in the Subject field of the certificate.
 
 ```shell
 * Rebuilt URL to: https://192.168.99.100:5044/