Using cloudid in logstash

This feature must be new because there are no examples.

You are supposed to put cloud.id and cloud.auth in config/logstash.yml.

My understanding is that would override the url provided in the logstash config file.But I get error 401, meaning it has not passed credentials to ES cloud. So what would you put here for hosts? It seems having the cloud.id would mean you don't need to put anything there at all.

output {
elasticsearch {
hosts => ["https://58571402f5464923883e7be42a037917.eu-central-1.aws.cloud.es.io:9243"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}

Seems using the cloud id not supported. So you have to explicitly define the ES endpoint and send it the password. Too bad for that.

output {
elasticsearch {
hosts => ["https://58571402f5464923883e7be42a037917.eu-central-1.aws.cloud.es.io:9243"]
user => "elastic"
password => "XXXXXXX"
index => "logstash-%{+YYYY.MM.dd}"
}
}

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.