# Ship Auditbeat logs directly to Elastic Cloud (MacOS)

**URL:** <https://discuss.elastic.co/t/ship-auditbeat-logs-directly-to-elastic-cloud-macos/220734>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 24, 2020, 10:46pm UTC](https://discuss.elastic.co/t/ship-auditbeat-logs-directly-to-elastic-cloud-macos/220734 "2020-02-24T22:46:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AaronWF](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@AaronWF](https://discuss.elastic.co/u/AaronWF)\
**Post date:** [February 24, 2020, 10:46pm UTC](https://discuss.elastic.co/t/ship-auditbeat-logs-directly-to-elastic-cloud-macos/220734/1 "2020-02-24T22:46:05Z")

</div>

I have signed up for an Elastic Cloud trial and I am trying to ship them directly to my Cloud ID instance. However, I am not sure where the error is, I have been checking the logs and no logs appear when it fails to start. I know it's a configuration issue because I can ship them to my self-hosted logstash instance just fine.

Note that i am using Auditbeat-8.0.0, and this was installed via DMG, not from a tarball/homebrew.

![Screen Shot 2020-02-24 at 2.44.15 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/0/8066223532d9ab04e3af010bd5692a5807b9dc9b.png)

---

<div class="post-metadata">

**Author:** ![AaronWF](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@AaronWF](https://discuss.elastic.co/u/AaronWF)\
**Post date:** [February 26, 2020, 9:57pm UTC](https://discuss.elastic.co/t/ship-auditbeat-logs-directly-to-elastic-cloud-macos/220734/2 "2020-02-26T21:57:30Z")

</div>

After fiddling with the configs, I decided to download the tarball and use my cloud.id & cloud.auth settings and I was able to send the logs to Elastic Cloud.

It appears that I had to use the elastic superuser rather than the user I had created.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2020, 9:57pm UTC](https://discuss.elastic.co/t/ship-auditbeat-logs-directly-to-elastic-cloud-macos/220734/3 "2020-03-18T21:57:32Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.