Sending data to Elasticsearch Serviceedit

Our hosted Elasticsearch Service is available on AWS, GCP, and Azure. You can try the Elasticsearch Service for free.

Logstash comes with two settings that simplify sending data to Elastic Cloud: Cloud ID and Cloud Auth.

Cloud IDedit

Logstash uses the Cloud ID, found in the Elastic Cloud web console, to build the Elasticsearch and Kibana hosts settings. It is a base64 encoded text value of about 120 characters made up of upper and lower case letters and numbers. If you have several Cloud IDs, you can add a label, which is ignored internally, to help you tell them apart. To add a label you should prefix your Cloud ID with a label and a : separator in this format "<label>:<cloud-id>"

Cloud Authedit

Cloud Auth is optional. Construct this value by following this format "<username>:<password>". Use your Cloud username for the first part. Use your Cloud password for the second part, which is given once in the Cloud UI when you create a cluster. If you change your Cloud password in the Cloud UI, remember to change it here, too.

Using Cloud ID and Cloud Auth with pluginsedit

The Elasticsearch input, output, and filter plugins support cloud_id and cloud_auth in their configurations.

Sending Logstash management data to Elasticsearch Servicesedit

These settings in the logstash.yml config file can help you get set up to send management data to Elastic Cloud:

  • xpack.management.elasticsearch.cloud_id
  • xpack.management.elasticsearch.cloud_auth

You can use the xpack.management.elasticsearch.cloud_id setting as an alternative to xpack.management.elasticsearch.hosts.

You can use the xpack.management.elasticsearch.cloud_auth setting as an alternative to both xpack.management.elasticsearch.username and xpack.management.elasticsearch.password. The credentials you specify here should be for a user with the logstash_admin role, which provides access to .logstash-* indices for managing configurations.