Elastic Cloud

About

Forward logs from your Elastic Cloud deployment into Sazabi using one of two paths: Elastic Agent running in OpenTelemetry Collector mode, or a Logstash pipeline that polls Elasticsearch and forwards records as OTLP log records.

Choose the path that matches your existing infrastructure.

Prerequisites

• Elastic Agent path: Elastic Agent 8.13 or later. Earlier versions do not support the embedded OTel Collector mode.
• Logstash path: Self-managed Logstash 8.x or 9.x running outside Elastic Cloud. Kibana's Pipelines UI stores pipeline config but does not run Logstash itself.
• Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)

Set up in the dashboard

receivers:
  filelog:
    include: [/var/log/**/*.log]
    start_at: beginning
  resourcedetection:
    detectors: [env, system]

processors:
  batch: {}

exporters:
  otlphttp/sazabi:
    endpoint: <your intake URL>

service:
  pipelines:
    logs:
      receivers: [filelog, resourcedetection]
      processors: [batch]
      exporters: [otlphttp/sazabi]

elastic-agent otel --config sazabi-otel.yml

input {
  elasticsearch {
    hosts => ["https://<your-deployment>.<region>.es.elastic.co:9243"]
    user => "elastic"
    password => "${ES_PASSWORD}"
    index => "logs-*"
    schedule => "* * * * *"
  }
}

filter {
  ruby {
    code => '
      record = event.to_hash
      event.set("[resourceLogs][0][scopeLogs][0][logRecords][0][body][stringValue]", record.to_json)
    '
  }
}

output {
  http {
    url => "<your intake URL>/v1/logs"
    http_method => "post"
    content_type => "application/json"
    format => "json"
  }
}

Set up with the CLI

You can also register the Elastic Cloud log source with the Sazabi CLI (installed and authenticated — see CLI reference).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

sazabi log-sources create elastic_cloud --mode connectionless

The command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

Verify

Trigger log activity in your Elastic environment — ingest a log event, invoke an application, or wait for the next Logstash poll cycle. Open the Intake page in the Sazabi dashboard and confirm records from the Elastic Cloud source appear within a minute or two (or within one Logstash poll cycle for the Logstash path).

Troubleshooting

Elastic Agent: no records after starting — Check the Elastic Agent output for errors from the otlphttp/sazabi exporter. Confirm the endpoint URL starts with https:// and the filelog receiver paths match log files that exist.

Logstash: no records after the first poll — Check Logstash logs for Elasticsearch connection errors or HTTP output errors. Confirm ES_PASSWORD is set in the Logstash environment and the Elasticsearch host URL is correct.

Logstash runs in Elastic Cloud — Kibana Pipelines stores config but Logstash must run outside Elastic Cloud. The HTTP output in the pipeline cannot originate from inside Elastic Cloud.

Further reading