Skip to content
downpipes docs

Forward the downpipes audit trail to Elastic

Elastic receives the downpipes audit trail through the Filebeat or Elastic Agent http_endpoint input. The engine dials out to that input’s HTTPS URL on the scheduler tick and posts the audit events as a JSON array, and the input splits the array into one document per event. This platform needs that input set up first, where Splunk and Datadog parse a first-time feed on their own.

The intake here is the http_endpoint input you run and expose yourself, not a hosted Elastic Cloud URL. Elastic Cloud has no generic HTTP log intake of its own, so you place the input on a Filebeat or Elastic Agent you control, and point the engine at it.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • A Filebeat or Elastic Agent you run, with the http_endpoint input you can configure and expose over HTTPS.
  • The input’s URL and any auth you set on it, and owner access to the downpipes console.

Set it up

  1. On your Filebeat or Elastic Agent, configure the http_endpoint input: set a listen host and port, a URL path, TLS, and (recommended) a secret header token. Point its output at your Elastic destination.
  2. Note the input’s public HTTPS URL and the secret header you set.
  3. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  4. Set the sink to HTTPS endpoint, the format to JSON array, and paste the input URL. The Datadog Logs intake array shape also splits cleanly if you prefer it.
  5. Set the auth header name and value to the secret header the input expects.
  6. Choose Test send and confirm the input accepts it, then Enable the destination.

What lands in Elastic

Each batch arrives as a JSON array of raw audit events, and the http_endpoint input emits one document per array element:

[{"seq":4097,"ts":"2026-06-19T02:14:08.221Z","actorEmail":"ops@acme.example","action":"restore-approve","outcome":"success","...":"..."}]

From there your Filebeat or Agent pipeline indexes the documents. Add an ingest pipeline if you want ts mapped to @timestamp, or the fields renamed to ECS.

Good to know

  • The http_endpoint input is yours to run and expose, not a hosted Elastic endpoint. Give it TLS and a secret header, since the engine dials out to it over the public internet.
  • The array splits into one document per event, and delivery is at-least-once. Dedup on the stable seq or hash. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .