> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Elastic Cloud

> Use Elastic Agent in OpenTelemetry Collector mode or a self-managed Logstash pipeline to forward logs from your Elastic Cloud deployment to Sazabi.

[All Elastic Cloud integration capabilities](https://docs.sazabi.com/catalogs/integrations/elastic-cloud)

## About

Forward logs from your Elastic Cloud deployment into Sazabi using one of two paths: **Elastic Agent** running in OpenTelemetry Collector mode, or a **Logstash** pipeline that polls Elasticsearch and forwards records as OTLP log records.

Choose the path that matches your existing infrastructure.

## Prerequisites

* **Elastic Agent path:** Elastic Agent 8.13 or later. Earlier versions do not support the embedded OTel Collector mode.
* **Logstash path:** Self-managed Logstash 8.x or 9.x running outside Elastic Cloud. Kibana's Pipelines UI stores pipeline config but does not run Logstash itself.
* Your Sazabi intake URL, shown above — open the log source and copy the **Intake URL** from its setup screen (the public key is embedded in the URL)

## Set up in the dashboard

> [tab] Elastic Agent
>
> **Step 1**
>
> ### Prepare the Elastic Agent config
>
> Use Elastic Agent in embedded OTel Collector mode (EDOT). Do not use Fleet Outputs for this — configure the OTel pipeline directly.
>
> Create a config file:
>
> ```yaml title="sazabi-otel.yml" theme={"system"}
> receivers:
>   filelog:
>     include: [/var/log/**/*.log]
>     start_at: beginning
>   resourcedetection:
>     detectors: [env, system]
>
> processors:
>   batch: {}
>
> exporters:
>   otlphttp/sazabi:
>     endpoint: <your intake URL>
>
> service:
>   pipelines:
>     logs:
>       receivers: [filelog, resourcedetection]
>       processors: [batch]
>       exporters: [otlphttp/sazabi]
> ```
>
> Replace `<your intake URL>` with the intake URL shown above.
>
> **Step 2**
>
> ### Run Elastic Agent in OTel mode
>
> ```bash theme={"system"}
> elastic-agent otel --config sazabi-otel.yml
> ```
>
> For Elastic Agent 9.2 and later using Fleet, you can attach an OpenTelemetry input package to an Agent Policy instead of running in standalone mode.
>
> **Step 3**
>
> ### Hand off the change
>
> If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly to your Elastic Agent. Keep the intake URL and any keys in environment variables or a secret store, and commit only configuration that references them.

> [tab] Logstash
>
> **Step 1**
>
> ### Create the Logstash pipeline config
>
> Create a pipeline configuration that polls Elasticsearch and forwards records to Sazabi:
>
> ```txt title="sazabi-pipeline.conf" theme={"system"}
> input {
>   elasticsearch {
>     hosts => ["https://<your-deployment>.<region>.es.elastic.co:9243"]
>     user => "elastic"
>     password => "${ES_PASSWORD}"
>     index => "logs-*"
>     schedule => "* * * * *"
>   }
> }
>
> filter {
>   ruby {
>     code => '
>       record = event.to_hash
>       event.set("[resourceLogs][0][scopeLogs][0][logRecords][0][body][stringValue]", record.to_json)
>     '
>   }
> }
>
> output {
>   http {
>     url => "<your intake URL>/v1/logs"
>     http_method => "post"
>     content_type => "application/json"
>     format => "json"
>   }
> }
> ```
>
> Replace `<your-deployment>.<region>.es.elastic.co` with your Elasticsearch endpoint and `<your intake URL>` with the Sazabi intake URL shown above.
>
> **Step 2**
>
> ### Run Logstash
>
> Run Logstash with this pipeline. Logstash polls `logs-*` every minute and forwards new documents to Sazabi.
>
> > [!WARNING]
> >
> > Kibana's Pipelines UI stores Logstash pipeline configuration but does not run
> > Logstash. You need a self-managed Logstash instance (outside Elastic Cloud) to
> > execute this pipeline.
>
> **Step 3**
>
> ### Hand off the change
>
> If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly to your Logstash deployment. Keep the intake URL and any keys in environment variables or a secret store, and commit only configuration that references them.

## Set up with the CLI

You can also register the Elastic Cloud log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create elastic_cloud --mode manual
```

The command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify

Trigger log activity in your Elastic environment — ingest a log event, invoke an application, or wait for the next Logstash poll cycle. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records from the **Elastic Cloud** source appear within a minute or two (or within one Logstash poll cycle for the Logstash path).

## Troubleshooting

**Elastic Agent: no records after starting** — Check the Elastic Agent output for errors from the `otlphttp/sazabi` exporter. Confirm the endpoint URL starts with `https://` and the `filelog` receiver paths match log files that exist.

**Logstash: no records after the first poll** — Check Logstash logs for Elasticsearch connection errors or HTTP output errors. Confirm `ES_PASSWORD` is set in the Logstash environment and the Elasticsearch host URL is correct.

**Logstash runs in Elastic Cloud** — Kibana Pipelines stores config but Logstash must run outside Elastic Cloud. The HTTP output in the pipeline cannot originate from inside Elastic Cloud.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health.

> [card] [OpenTelemetry Collector](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/otel-collector.md)
>
> Use the OpenTelemetry Collector as a standalone pipeline agent.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.