hello stephen,
thanks for your answer.
normally i have the elasticsearch cluster outside the GCP, installed on a physical servers. but i can create a filebeat instance if it's needed.
so if i understand i don't need the cloud id and cloud.auth to export logs to my on premise elasticsearch?
they can be replaced by the http or https link to elasticsearch