diff --git a/apis/fluentd/v1alpha1/plugins/output/es.go b/apis/fluentd/v1alpha1/plugins/output/es.go
index 369a8f150..47f656b8d 100644
--- a/apis/fluentd/v1alpha1/plugins/output/es.go
+++ b/apis/fluentd/v1alpha1/plugins/output/es.go
@@ -16,6 +16,11 @@ type Elasticsearch struct {
 	Scheme *string `json:"scheme,omitempty"`
 	// Path defines the REST API endpoint of Elasticsearch to post write requests (default: nil).
 	Path *string `json:"path,omitempty"`
+	// Authenticate towards Elastic Cloud using CloudId. If set, cloudAuth must
+	// be set as well and host, port, user and password are ignored.
+	CloudId *string `json:"cloudId,omitempty"`
+	// Authenticate towards Elastic Cloud using cloudAuth.
+	CloudAuth *string `json:"cloudAuth,omitempty"`
 	// IndexName defines the placeholder syntax of Fluentd plugin API. See https://docs.fluentd.org/configuration/buffer-section.
 	IndexName *string `json:"indexName,omitempty"`
 	// If true, Fluentd uses the conventional index name format logstash-%Y.%m.%d (default: false). This option supersedes the index_name option.
diff --git a/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_clusteroutputs.yaml b/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_clusteroutputs.yaml
index cc69e61fa..5d131c3ca 100644
--- a/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_clusteroutputs.yaml
+++ b/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_clusteroutputs.yaml
@@ -596,6 +596,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
diff --git a/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_outputs.yaml b/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_outputs.yaml
index bacfb15fa..5fb665748 100644
--- a/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_outputs.yaml
+++ b/charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_outputs.yaml
@@ -596,6 +596,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
diff --git a/config/crd/bases/fluentd.fluent.io_clusteroutputs.yaml b/config/crd/bases/fluentd.fluent.io_clusteroutputs.yaml
index cc69e61fa..5d131c3ca 100644
--- a/config/crd/bases/fluentd.fluent.io_clusteroutputs.yaml
+++ b/config/crd/bases/fluentd.fluent.io_clusteroutputs.yaml
@@ -596,6 +596,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
diff --git a/config/crd/bases/fluentd.fluent.io_outputs.yaml b/config/crd/bases/fluentd.fluent.io_outputs.yaml
index bacfb15fa..5fb665748 100644
--- a/config/crd/bases/fluentd.fluent.io_outputs.yaml
+++ b/config/crd/bases/fluentd.fluent.io_outputs.yaml
@@ -596,6 +596,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
diff --git a/docs/plugins/fluentd/output/es.md b/docs/plugins/fluentd/output/es.md
index f9736751f..43ab8dc80 100644
--- a/docs/plugins/fluentd/output/es.md
+++ b/docs/plugins/fluentd/output/es.md
@@ -10,6 +10,8 @@ Elasticsearch defines the parameters for out_es output plugin
 | hosts | Hosts defines a list of hosts if you want to connect to more than one Elasticsearch nodes | *string |
 | scheme | Specify https if your Elasticsearch endpoint supports SSL (default: http). | *string |
 | path | Path defines the REST API endpoint of Elasticsearch to post write requests (default: nil). | *string |
+| cloudId | Authenticate towards Elastic Cloud using CloudId. If set, cloudAuth must be set as well and host, port, user and password are ignored. | *string |
+| cloudAuth | Authenticate towards Elastic Cloud using cloudAuth. | *string |
 | indexName | IndexName defines the placeholder syntax of Fluentd plugin API. See https://docs.fluentd.org/configuration/buffer-section. | *string |
 | logstashFormat | If true, Fluentd uses the conventional index name format logstash-%Y.%m.%d (default: false). This option supersedes the index_name option. | *bool |
 | logstashPrefix | LogstashPrefix defines the logstash prefix index name to write events when logstash_format is true (default: logstash). | *string |
diff --git a/manifests/setup/fluent-operator-crd.yaml b/manifests/setup/fluent-operator-crd.yaml
index b9073c72f..8ccc06481 100644
--- a/manifests/setup/fluent-operator-crd.yaml
+++ b/manifests/setup/fluent-operator-crd.yaml
@@ -7494,6 +7494,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
@@ -32138,6 +32146,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
diff --git a/manifests/setup/setup.yaml b/manifests/setup/setup.yaml
index 531ca525a..a74ac067c 100644
--- a/manifests/setup/setup.yaml
+++ b/manifests/setup/setup.yaml
@@ -7494,6 +7494,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'
@@ -32138,6 +32146,14 @@ spec:
                                   x-kubernetes-map-type: atomic
                               type: object
                           type: object
+                        cloudAuth:
+                          description: Authenticate towards Elastic Cloud using cloudAuth.
+                          type: string
+                        cloudId:
+                          description: Authenticate towards Elastic Cloud using CloudId.
+                            If set, cloudAuth must be set as well and host, port,
+                            user and password are ignored.
+                          type: string
                         host:
                           description: 'The hostname of your Elasticsearch node (default:
                             localhost).'