# Unable to connect to Elastic Cloud using cloud\_id and cloud\_auth

**URL:** <https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745>\
**Category:** Logstash\
**Created:** [April 3, 2025, 1:45pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745 "2025-04-03T13:45:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francesco\_Esposito](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/francesco_esposito/32/141865_2.png) [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\
**Post date:** [April 3, 2025, 1:45pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745/1 "2025-04-03T13:45:34Z")

</div>

Good morning,

I am trying to connect with Elasticsearch Output Plugin using cloud\_id and cloud\_auth. I receive an error message about permissions to access https://my\_cloud\_instance/\_license, looks like, for a grant problem.

The Logstash configuration of the plugin:

```auto
output {
     elasticsearch {
          cloud_id => "my_cloud_id"
          cloud_auth => "my_user:my_password"
          index => "journaling_insert"
     }
}

```

If I try to access the same url (https://my\_cloud\_instance.com/\_license) that Logstash is complaining about thru browser and I try to login at the prompt I receive the following message as well:

```auto
{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "action [cluster:monitor/xpack/license/get] is unauthorized for user [my_user] with effective roles [application_writer,ccsettlement_manager,dfm_location_detail_manager,epic_gl_txn_writer,gti_writer,journal_writer,monitoring_user,reportable_writer,virtualcard_writer], this action is granted by the cluster privileges [monitor,manage,all]"
            }
        ],
        "type": "security_exception",
        "reason": "action [cluster:monitor/xpack/license/get] is unauthorized for user [my_user] with effective roles [application_writer,ccsettlement_manager,dfm_location_detail_manager,epic_gl_txn_writer,gti_writer,journal_writer,monitoring_user,reportable_writer,virtualcard_writer], this action is granted by the cluster privileges [monitor,manage,all]"
    },
    "status": 403
}
That is a 403 Not Authorized.

```

Let’s clarify that if I use HTTP Output Plugin with same username and password:

```auto
output {
     http {
          http_method=>"post"
          format => "message"
          url => "https://my_cloud_instance/_bulk"
          content_type => "application/json"
          message => "%{[message]}"
          headers => { "Authorization" => "Basic my_hashed_user+password" } 
     }
}

```

it works perfectly fine.

Do you guys have any hint?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 3, 2025, 1:52pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745/2 "2025-04-03T13:52:40Z")

</div>

The root cause is pretty on point, your user does not have the required role to check the license version, which is `cluster:monitor/xpack/license/get`.

None of the roles that the user has will give this permission, you need to creat a new role with it or edit and old one to add this.

You can also add the `monitor` cluster permission to add all monitoring permissions to the user.

> [@Francesco\_Esposito](#):
>
> it works perfectly fine.

The HTTP output works fine because it does not check for the license, the `elasticsearch` ouput does a pre-check for the license.