Modify ca statement (#1971) (#2016)

* Add workaround for restriction around intermediate CAs
* Add FAQ topic to Filebeat doc explaining that newline is required at eof
* Move comment about merging certificates

filebeat/docs/faq.asciidoc

@@ -4,13 +4,25 @@
 This section contains frequently asked questions about Filebeat. Also check out the
 https://discuss.elastic.co/c/beats/filebeat[Filebeat discussion forum].
 
+* <<filebeat-network-volumes>>
+* <<filebeat-not-collecting-lines>>
+* <<filebeat-cpu>>
+* <<dashboard-fields-incorrect-filebeat>>
+* <<newline-character-required-eof>>
+* <<connection-problem>>
+* <<metadata-missing>>
+* <<diff-logstash-beats>>
+* <<ssl-client-fails>>
+
+
 [[filebeat-network-volumes]]
 === Why can't I read log files from network volumes?
 
 We do not recommend reading log files from network volumes. Whenever possible, install Filebeat on the host machine and
 send the log files directly from there. Reading files from network volumes (especially on Windows) can have unexpected side
 effects. For example, changed file identifiers may result in Filebeat reading a log file from scratch again.
 
+[[filebeat-not-collecting-lines]]
 === Why isn’t Filebeat collecting lines from my file?
 
 Filebeat might be incorrectly configured or unable to send events to the output. To resolve the issue:
@@ -41,4 +53,11 @@ config file. Setting `scan_frequency` to less than 1s may cause Filebeat to scan
 
 The index template might not be loaded correctly. See <<filebeat-template>>.
 
+[[newline-character-required-eof]]
+=== Why isn't Filebeat shipping the last line of my file?
+
+Filebeat uses a newline character to detect the end of an event. If lines are added incrementally to a file that's being
+harvested, a newline character is required after the last line, or Filebeat will not read the last line of
+the file.
+
 include::../../libbeat/docs/shared-faq.asciidoc[]

libbeat/docs/shared-tls-logstash-config.asciidoc

@@ -22,13 +22,18 @@ To use TLS mutual authentication:
 {beatname_uc} and Logstash. Creating a correct SSL/TLS infrastructure is outside the scope of this
 document. There are many online resources available that describe how to create certificates.
 +
-NOTE: Certificates must be signed by your root CA. Intermediate CAs are currently not supported. 
+NOTE: Certificates must be signed by your root CA. Intermediate CAs are currently not supported.
 
 . Configure {beatname_uc} to use TLS. In the +{beatname_lc}.yml+ config file, specify the following settings under
 `tls`: 
 +
 * `certificate_authorities`: Configures {beatname_uc} to trust any certificates signed by the specified CA. If
 `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
++
+Although  intermediate CAs are currently not supported, you may be able to work around this issue by merging all the
+certificates in the chain into one file. You can create the PEM file containing the CA chain by concatenating the root CA
+cert and the intermediate CA into a single file: `cat root-ca.crt intermediate-ca.crt > chain.crt`. Then set `certificate_authorities` to use this file: `certificate_authorities: ['chain.crt']`.
+
 * `certificate` and `certificate_key`: Specifies the certificate and key that {beatname_uc} uses to authenticate with 
 Logstash.
 +