# Configuration problem

**URL:** https://discuss.elastic.co/t/configuration-problem/274358
**Category:** Logstash
**Created:** [May 28, 2021, 3:35pm UTC](https://discuss.elastic.co/t/configuration-problem/274358 "2021-05-28T15:35:55Z")
**Posts on this page:** 1
**Showing post:** 10

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 29, 2021, 4:28am UTC](https://discuss.elastic.co/t/configuration-problem/274358/10 "2021-05-29T04:28:51Z")

</div>

Perhaps take a look at [this](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593/7) thread

It refers to Packetbeat but the concept / code is the same.

Assuming you just want to use log stash as the pass through then Your logstash conf file should look like this

```auto
################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      cloud_auth => "elastic:password"
      cloud_id => "mycloud:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRj......"

      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
    }
  } else {
    elasticsearch {
      cloud_auth => "elastic:password"
      cloud_id => "mycloud:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRj......"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/configuration-problem/274358)._