# Export Teleport Audit Events to the Elastic Stack

**URL:** <https://discuss.elastic.co/t/export-teleport-audit-events-to-the-elastic-stack/340997>\
**Category:** Kibana\
**Created:** [August 17, 2023, 10:25am UTC](https://discuss.elastic.co/t/export-teleport-audit-events-to-the-elastic-stack/340997 "2023-08-17T10:25:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jana1](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@jana1](https://discuss.elastic.co/u/jana1)\
**Post date:** [August 17, 2023, 10:25am UTC](https://discuss.elastic.co/t/export-teleport-audit-events-to-the-elastic-stack/340997/1 "2023-08-17T10:25:47Z")

</div>

i need help with Exporting Teleport Audit logs to the Elastic Stack - KIbana  
i am beginner on everything thats way i faced a problem in each step .  
i need help on explaining how to do all that

the things that i did installed logstash and kibana on my auth server and they are enabled  
also i created the event handler and thats it  
i don't know how to connect every thing together .

i am using Elastic Cloud account.  
also teleport self host  
i need step by step please

---

<div class="post-metadata">

**Author:** ![deepybee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepybee/32/20381_2.png) [@deepybee](https://discuss.elastic.co/u/deepybee)\
**Post date:** [September 7, 2023, 10:02am UTC](https://discuss.elastic.co/t/export-teleport-audit-events-to-the-elastic-stack/340997/2 "2023-09-07T10:02:44Z")

</div>

Teleport has extensive docs for precisely this scenario, covering both Elastic on prem and cloud backends:

> **[Export Teleport Audit Events to the Elastic Stack | Teleport Docs](https://goteleport.com/docs/management/export-audit-events/elastic-stack/)**
>
> How to configure Teleport's Event Handler plugin to send audit events to the Elastic Stack

> the things that i did installed logstash and kibana on my auth server and they are enabled

Why? Kibana is already available in your Elastic Cloud account, you don't need to run one on prem as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2023, 10:03am UTC](https://discuss.elastic.co/t/export-teleport-audit-events-to-the-elastic-stack/340997/3 "2023-10-05T10:03:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.