# What should be specified in the filebeats config to connect to Elastic search cloud?

**URL:** <https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 4, 2024, 4:57pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401 "2024-01-04T16:57:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcc2186](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jcc2186](https://discuss.elastic.co/u/jcc2186)\
**Post date:** [January 4, 2024, 4:57pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/1 "2024-01-04T16:57:22Z")

</div>

I am trying to setup filebeats to connect to elasticsearch cloud to send my custom application .json log file.

What configuration setting do I need to add to the filebeat.yml config to send logs to the correct elasticsearch cloud instance ?

Running a

```auto
-> % ./filebeat test output
elasticsearch: https://jcc-firstdeployment.kb.us-central1.gcp.cloud.es.io:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 35.193.143.25
    dial up... ERROR dial tcp 35.193.143.25:9200: connect: operation timed out

```

checking config with f **ilebeat test config** - is OK.

I believe to be pointing this to the incorrect cloud location.... can someone assist?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 4, 2024, 5:31pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/2 "2024-01-04T17:31:30Z")

</div>

> [@jcc2186](#):
>
> `https://jcc-firstdeployment.kb.us-central1.gcp.cloud.es.io`

I do not use Elastic Cloud, but if I'm not wrong this endpoint is for **Kibana** , it as a `kb` , you need to use the endpoint to Elasticsearch.

I think you just need to replace the `kb` by `es`.

---

<div class="post-metadata">

**Author:** ![jcc2186](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jcc2186](https://discuss.elastic.co/u/jcc2186)\
**Post date:** [January 4, 2024, 5:44pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/3 "2024-01-04T17:44:54Z")

</div>

Thank you, unfortunately, changing from "kb" to "es" results in the same error:

```auto

elasticsearch: https://jcc-firstdeployment.es.us-central1.gcp.cloud.es.io:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 35.193.143.25
    dial up... ERROR dial tcp 35.193.143.25:9200: connect: operation timed out

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 4, 2024, 5:45pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/4 "2024-01-04T17:45:40Z")

</div>

> [@leandrojmp](#):
>
> I think you just need to replace the `kb` by `es`.

That is correct... BUT you need to add the port `:443` otherwise it will default to `9200`, which is not correct (that should be in the docs)

`https://jcc-firstdeployment.es.us-central1.gcp.cloud.es.io:443`

`cloud.id` will work as is

 ![Screenshot 2024-01-04 at 9.36.40 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b14264cc98180cb4d63ae651418f29c4a3b6eb78.png)

---

<div class="post-metadata">

**Author:** ![jcc2186](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jcc2186](https://discuss.elastic.co/u/jcc2186)\
**Post date:** [January 4, 2024, 7:52pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/5 "2024-01-04T19:52:40Z")

</div>

Looks like that might have done it, thank you.  
I have a different problem now:

Error:

```auto
talk to server... ERROR failed to parse JSON response: invalid character '<' looking for beginning of value

```

however I will work off of these new errors now and circle back via a separate thread if I hit a wall

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2024, 9:53pm UTC](https://discuss.elastic.co/t/what-should-be-specified-in-the-filebeats-config-to-connect-to-elastic-search-cloud/350401/6 "2024-02-01T21:53:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.