IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Working with Logstash Modules Logstash ArcSight Module »
Elastic Docs ›Logstash Reference [7.5] ›Working with Logstash Modules

Using Elastic Cloud

edit

Using Elastic Cloud

edit

Logstash comes with two settings that simplify using modules with Elastic Cloud. The Elasticsearch and Kibana hostnames in Elastic Cloud may be hard to set in the Logstash config or on the commandline, so a Cloud ID can be used instead.

Cloud ID applies only when a Logstash module is enabled, otherwise specifying Cloud ID has no effect. Cloud ID applies to data that gets sent via the module, to runtime metrics sent via X-Pack monitoring, and to the endpoint used by X-Pack central management features of Logstash, unless explicit overrides to X-Pack settings are specified in logstash.yml.

Cloud ID

edit

The Cloud ID, which can be found in the Elastic Cloud web console, is used by Logstash to build the Elasticsearch and Kibana hosts settings. It is a base64 encoded text value of about 120 characters made up of upper and lower case letters and numbers. If you have several Cloud IDs, you can add a label, which is ignored internally, to help you tell them apart. To add a label you should prefix your Cloud ID with a label and a : separator in this format "<label>:<cloud-id>"

cloud.id will overwrite these settings:

var.elasticsearch.hosts
var.kibana.host

Cloud Auth

edit

This is optional. Construct this value by following this format "<username>:<password>". Use your Cloud username for the first part. Use your Cloud password for the second part, which is given once in the Cloud UI when you create a cluster. As your Cloud password is changeable, if you change it in the Cloud UI remember to change it here too.

cloud.auth when specified will overwrite these settings:

var.elasticsearch.username
var.elasticsearch.password
var.kibana.username
var.kibana.password

Example:

These settings can be specified in the logstash.yml settings file. They should be added separately from any module configuration settings you may have added before.

# example with a label
cloud.id: "staging:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy"
cloud.auth: "elastic:YOUR_PASSWORD"
# example without a label
cloud.id: "dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy"
cloud.auth: "elastic:YOUR_PASSWORD"

These settings can be also specified at the command line, like this:

bin/logstash --modules netflow -M "netflow.var.input.udp.port=3555" --cloud.id <cloud-id> --cloud.auth <cloud.auth>
« Working with Logstash Modules Logstash ArcSight Module »