# Cloudtrail (and other) integrations

**URL:** <https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854>\
**Category:** Elastic Observability\
**Created:** [October 15, 2024, 2:58pm UTC](https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854 "2024-10-15T14:58:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sami-obvio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sami-obvio/32/138170_2.png) [@sami-obvio](https://discuss.elastic.co/u/sami-obvio)\
**Post date:** [October 15, 2024, 2:58pm UTC](https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854/1 "2024-10-15T14:58:50Z")

</div>

Hi

I would like to understand something about Elastic integration architecture

I want to pull Cloudtrail logs into an Elastic Cloud cluster

And it's asking me to install an agent on my VM

I am curious why can't Elastic have a runtime that can pull the logs off cloudtrail for me and ingest it? Or it could install the agent itself in one of the VMs the cluster is running on...

I am curious about the choice on why this is done?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 15, 2024, 3:11pm UTC](https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854/2 "2024-10-15T15:11:14Z")

</div>

Hi @sami-obvio

Good /common question.

Elastic agent comes from a heritage of edge shippers installed close to the source of the telemetry. So today for most integrations you need to install the agent somewhere to collect your telemetry.

In the future there will be more agentless shippers where you will not need to install The agent.

There are already a couple agentless integrations.

Today you can use the firehose integration which requires no agent installation. However, you need to be running on Elastic Cloud

You would have to route your cloudtrail logs through firehose.

> **[Amazon Data Firehose | Documentation](https://www.elastic.co/docs/current/integrations/awsfirehose)**
>
> Stream logs and metrics from Amazon Data Firehose into Elastic Cloud.

> **[Amazon Kinesis Data Firehose overview | Amazon Kinesis Data Firehose Ingest...](https://www.elastic.co/guide/en/kinesis/master/aws-firehose.html)**

Hope this helps.

---

<div class="post-metadata">

**Author:** ![sami-obvio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sami-obvio/32/138170_2.png) [@sami-obvio](https://discuss.elastic.co/u/sami-obvio)\
**Post date:** [October 15, 2024, 3:19pm UTC](https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854/3 "2024-10-15T15:19:41Z")

</div>

Thanks Stephen - I am using Elastic again after a few years - the last time I set everything up on prem and used it for a geosearch product, API tracking and obversability, it was loads of fun - this time things are a bit different....

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 16, 2024, 2:03am UTC](https://discuss.elastic.co/t/cloudtrail-and-other-integrations/368854/4 "2024-10-16T02:03:59Z")

</div>

Please come back and ask more!!