diff --git a/docs/en/observability/images/es-endpoint-cluster-id.png b/docs/en/observability/images/es-endpoint-cluster-id.png
deleted file mode 100644
index ed408bc3a0..0000000000
Binary files a/docs/en/observability/images/es-endpoint-cluster-id.png and /dev/null differ
diff --git a/docs/en/observability/images/help-icon.png b/docs/en/observability/images/help-icon.png
new file mode 100644
index 0000000000..49eefac61a
Binary files /dev/null and b/docs/en/observability/images/help-icon.png differ
diff --git a/docs/en/observability/logs-ecs-application.asciidoc b/docs/en/observability/logs-ecs-application.asciidoc
index 2875d4909a..bb9bd8ab81 100644
--- a/docs/en/observability/logs-ecs-application.asciidoc
+++ b/docs/en/observability/logs-ecs-application.asciidoc
@@ -88,12 +88,7 @@ output.elasticsearch:
   api_key: "id:api_key"
 ----
 
-. Set the `hosts` to your deployment's {es} endpoint. Copy the {es} endpoint from your deployment's page and add the port (the default port is `443`). For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
-+
---
-[role="screenshot"]
-image::images/es-endpoint-cluster-id.png[{es} endpoint and cluster id location, 50%]
---
+. Set the `hosts` to your deployment's {es} endpoint. Copy the {es} endpoint from *Help menu (image:images/help-icon.png[]) → Connection details*. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
 . From **Developer tools**, run the following command to create an API key that grants `manage` permissions for the `cluster` and the `filebeat-*` indices using:
 +
 [source,console]
diff --git a/docs/en/observability/logs-plaintext.asciidoc b/docs/en/observability/logs-plaintext.asciidoc
index 65ac1280f0..ad5c34d111 100644
--- a/docs/en/observability/logs-plaintext.asciidoc
+++ b/docs/en/observability/logs-plaintext.asciidoc
@@ -50,12 +50,7 @@ output.elasticsearch:
   api_key: "id:api_key"
 ----
 
-. Set the `hosts` to your deployment's {es} endpoint. Copy the {es} endpoint from your deployment's page and add the port (the default port is `443`). For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
-+
---
-[role="screenshot"]
-image::images/es-endpoint-cluster-id.png[{es} endpoint and cluster id location, 50%]
---
+. Set the `hosts` to your deployment's {es} endpoint. Copy the {es} endpoint from *Help menu (image:images/help-icon.png[]) → Connection details*. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
 . From **Developer tools**, run the following command to create an API key that grants `manage` permissions for the `cluster` and the `filebeat-*` indices using:
 +
 [source,console]
diff --git a/docs/en/observability/logs-stream.asciidoc b/docs/en/observability/logs-stream.asciidoc
index 472b1fd815..05eff2d7fc 100644
--- a/docs/en/observability/logs-stream.asciidoc
+++ b/docs/en/observability/logs-stream.asciidoc
@@ -84,12 +84,7 @@ inputs:
 
 Next, set the values for these fields:
 
-- `hosts` – Copy the {es} endpoint from your deployment's page and add the port (the default port is `443`). For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
-+
---
-[role="screenshot"]
-image::images/es-endpoint-cluster-id.png[{es} endpoint and cluster id location, 50%]
---
+- `hosts` – Copy the {es} endpoint from *Help menu (image:images/help-icon.png[]) → Connection details*. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`.
 - `api-key` – Use an API key to grant the agent access to {es}. To create an API key for your agent, refer to the {fleet-guide}/grant-access-to-elasticsearch.html#create-api-key-standalone-agent[Create API keys for standalone agents] documentation.
 +
 NOTE: The API key format should be `<id>:<key>`. Make sure you selected *Beats* when you created your API key. Base64 encoded API keys are not currently supported in this configuration.
diff --git a/docs/en/observability/logs-troubleshooting.asciidoc b/docs/en/observability/logs-troubleshooting.asciidoc
index 57a45a05f2..531be77c97 100644
--- a/docs/en/observability/logs-troubleshooting.asciidoc
+++ b/docs/en/observability/logs-troubleshooting.asciidoc
@@ -63,10 +63,7 @@ Failed to connect to {host} port {port} after 0 ms: Connection refused
 [[logs-troubleshooting-kib-not-accessible-solution]]
 === Solution
 
-The host needs access to {kib}. Port `443` must be open and the deployment's {es} endpoint must be reachable. Locate your project's endpoint on the deployment page under *Applications*:
-
-[role="screenshot"]
-image::images/es-endpoint-cluster-id.png[{es} endpoint location, 50%]
+The host needs access to {kib}. Port `443` must be open and the deployment's {es} endpoint must be reachable. Locate your project's endpoint from *Help menu (image:images/help-icon.png[]) → Connection details*.
 
 Run the following command, replacing the URL with your endpoint, and you should get an authentication error with more details on resolving your issue: