# Cisco Umbrella logs ingestion - Elastic Cloud **URL:** \ **Category:** SIEM\ **Created:** [April 4, 2022, 2:45pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530 "2022-04-04T14:45:28Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![misiel](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@misiel](https://discuss.elastic.co/u/misiel)\ **Post date:** [April 4, 2022, 2:45pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/1 "2022-04-04T14:45:28Z")
Hello I started Elastic Cloud service trial period. I want to ingest Cisco Umbrella logs using Cisco Umbrella integration. Documentation says, that I have to install Elastic Agent in order to ship the logs (logs from self-managed S3 bucket). I assume Elastic Agent should be installed on Elastic instance. How can I install Elastic Agent if the Elastic deployment is not self-hosted? Or is there something what I missunderstand? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [April 4, 2022, 3:40pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/2 "2022-04-04T15:40:02Z")
No The Elastic Agent should be on a VM / Ec2 instance in your environment that can access that S3 Bucket. `S3 Bucket -> Elastic Agent (in your VPC / EC2) -> Elastic Cloud ` At some point in the future we may have a hosted agent ---
**Author:** ![misiel](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@misiel](https://discuss.elastic.co/u/misiel)\ **Post date:** [April 5, 2022, 9:16am UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/3 "2022-04-05T09:16:55Z")
Thank you @stephenb Can you tell me what else, except installing the Elastic Agent on EC2 instance, should be configured to successfuly receive logs from self-managed S3 bucket? I am interested in S3 pooling method. I installed the integration: - queue URL - here I put the bucket ARN as field description suggests - Access Key ID - IAM user who has permissions to read from S3 bucket - Secret Access Key - as above Anything should be configured on EC2 after installing the agent? I am not receiving any data. Outboud network communication is allowed. Thank you! ---
**Author:** ![misiel](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@misiel](https://discuss.elastic.co/u/misiel)\ **Post date:** [April 5, 2022, 11:55am UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/4 "2022-04-05T11:55:50Z")
Issue resolved. I reconfigured the integration and logs are successfully shipped. No additional configuration on EC2 was needed. Thank you. ---
**Author:** ![misiel](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@misiel](https://discuss.elastic.co/u/misiel)\ **Post date:** [April 5, 2022, 1:21pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/5 "2022-04-05T13:21:02Z")
But I have one more question. I have a gap in logs between 30.03 and 04.04: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1bc3d0941f6af7a01a030378d1ec3cee14b35ff4.png) How can I investigate what caused this gap? How can I enforce to pull the missing logs from S3 buckets? (there are in S3 for sure, there are just missing in Elastic) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 3, 2022, 1:21pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530/6 "2022-05-03T13:21:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.