Architecture of elasticsearch-xpack monitoring with Metricbeat

Documentation (Collecting Elasticsearch monitoring data with Metricbeat | Elasticsearch Guide [7.13] | Elastic) says: "Ideally install a single Metricbeat instance configured with scope: cluster and configure hosts to point to an endpoint (e.g. a load-balancing proxy) which directs requests to the master-ineligible nodes in the cluster."

But if i have only 1 metricbeat configured, there is single point of failure, and if i have metricbeat on the other master-eligible nodes as well with scope: cluster, they are collecting the same data and producing triple the amount of logs.

What is the best configuration for a large production cluster? I tried to have metricbeat to each node with scope: node, but it's not even working well (data comes from time to time on big chunks).

What is the best configuration for a large production cluster? I tried to have metricbeat to each node with scope: node, but it's not even working well (data comes from time to time on big chunks).

You can configure delivery periods and size of chunks (I think).

Thank you for your reply!
Yes, there are period settings, but if you make it more than 10 secs, data starts to appear as dots instead of chart.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.