Sending data to Elasticsearch Service

Logstash uses the Cloud ID, found in the Elastic Cloud web console, to build the Elasticsearch and Kibana hosts settings. It is a base64 encoded text value of about 120 characters made up of upper and lower case letters and numbers. If you have several Cloud IDs, you can add a label, which is ignored internally, to help you tell them apart. To add a label you should prefix your Cloud ID with a label and a : separator in this format "<label>:<cloud-id>"

Cloud Auth is optional. Construct this value by following this format "<username>:<password>". Use your Cloud username for the first part. Use your Cloud password for the second part, which is given once in the Cloud UI when you create a cluster. If you change your Cloud password in the Cloud UI, remember to change it here, too.

The Elasticsearch input, output, and filter plugins support cloud_id and cloud_auth in their configurations.

These settings in the logstash.yml config file can help you get set up to send management data to Elastic Cloud:

You can use the xpack.management.elasticsearch.cloud_id setting as an alternative to xpack.management.elasticsearch.hosts.

You can use the xpack.management.elasticsearch.cloud_auth setting as an alternative to both xpack.management.elasticsearch.username and xpack.management.elasticsearch.password. The credentials you specify here should be for a user with the logstash_admin role, which provides access to .logstash-* indices for managing configurations.