> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/integrations/siem/elastic.md).

# Elastic

Learn how to send events to Logstash to use with Elastic from Couchdrop

## Overview

Couchdrop can send selected events to Logstash for centralized logging and downstream processing.

Configuration is completed in two parts:

1. **Configure Logstash** — Set up the Logstash HTTP input plugin so it can receive events from Couchdrop, then collect the connection details Couchdrop will use.
2. **Configure Couchdrop** — Enter those Logstash connection details in Couchdrop, choose which events to send, and save the configuration.

## Configure Logstash settings in Elastic

{% hint style="warning" %}

#### Before you start

To configure Logstash for Couchdrop, you will need:

* A Logstash instance.
* The Logstash HTTP input plugin configured to receive events.
  {% endhint %}

{% stepper %}
{% step %}

### Configure the HTTP input

Configure the Logstash HTTP input plugin so Logstash can receive events from Couchdrop.

For more information, see the [Logstash HTTP input plugin documentation](https://www.elastic.co/docs/reference/logstash/plugins/plugins-inputs-http).
{% endstep %}

{% step %}

### Collect your Logstash connection details

Before configuring Couchdrop, make sure you have:

* **Elastic Username**
* **Elastic Password**
* **Elastic URL**
  {% endstep %}
  {% endstepper %}

## Set up Logstash logging in Couchdrop

{% hint style="warning" %}

#### Before you start

To configure Logstash logging in Couchdrop, you will need:

* A Couchdrop account with access to the SIEM logging settings.
* Your Elastic username, password, and URL.
  {% endhint %}

{% stepper %}
{% step %}

### Open Logstash logging settings

Log in to Couchdrop and navigate to **Admin Panel → Logging**.

Select **Connect** or **Manage** on the Elastic provider.
{% endstep %}

{% step %}

### Select events to send

Select the Couchdrop events you want to send to Logstash.
{% endstep %}

{% step %}

### Enter your Logstash configuration

Configure the required Logstash fields:

* **Elastic Username**
* **Elastic Password**
* **Elastic URL**
  {% endstep %}

{% step %}

### Save the configuration

Click **Save Updates**.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/integrations/siem/elastic.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.