# Cannot Monitor Logstash

**URL:** <https://discuss.elastic.co/t/cannot-monitor-logstash/81957>\
**Category:** Logstash\
**Created:** [April 11, 2017, 10:30am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957 "2017-04-11T10:30:45Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 11, 2017, 10:30am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/1 "2017-04-11T10:30:45Z")

</div>

Hi,

Logstash is not showing in the Monitor Tab of Kibana. Only Elasicsearch and Kibana is showing.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/5/951a3f280d4d45ce1fc3d456271649c85f975052.png)

I have configured mypipeline.conf

```auto
input { stdin { }}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] }
  stdout { codec => rubydebug }
}

```

This is my logstash.yml

```auto
xpack.monitoring.elasticsearch.url: ["http://CTLSQL12WPPOC:9200", "http://CTLWIN12SM1:9200"]
xpack.monitoring.elasticsearch.username: "logstash_system" 
xpack.monitoring.elasticsearch.password: "changeme"

```

Please advise on what is lacking. Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2017, 10:51am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/2 "2017-04-11T10:51:18Z")

</div>

Have you [installed the X-Pack plugin in Logstash](https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html)?

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 11, 2017, 12:01pm UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/3 "2017-04-11T12:01:49Z")

</div>

Yes, I have installed X-PACK on both servers. Thanks!

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 2:53am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/4 "2017-04-12T02:53:21Z")

</div>

Hi Christian,

Is there a missing configuration? Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 12, 2017, 4:33am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/5 "2017-04-12T04:33:51Z")

</div>

That looks correct as far as I can see. Can you run `bin/logstash-plugin list` to verify that the x-pack plugin was installed successfully? Is there anything in the Logstash logs?

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 5:45am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/6 "2017-04-12T05:45:25Z")

</div>

Hi,

Upon checking, there is no monitoring-logstash created.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5364170f6629f197315b079e22dd336ef2ef9e2.png)

I have also checked the list of plugins for logstash and x-pack is included.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 12, 2017, 5:58am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/7 "2017-04-12T05:58:48Z")

</div>

Is Logstash running? Is it processing any data?

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 6:01am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/8 "2017-04-12T06:01:35Z")

</div>

Hi Christian,

I have changed my conf file.

```auto
input {
  beats {
    port => 5044
  },
  user => logstash_internal
  password => changeme
}

output {
  elasticsearch {
    hosts => "CTLSQL12WPPOC:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  },
  user => logstash_internal
  password => changeme
}

```

In the services, logstash is running.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8ee1e2aa205834e8d7d1dc4398d9c4d5c09d713d.png)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 12, 2017, 6:06am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/9 "2017-04-12T06:06:56Z")

</div>

> [@arianayay](#):
>
> user =\> logstash\_internal  
> password =\> changeme

These sections are not in the right place. It should be within the Elasticsearch block.

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 6:12am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/10 "2017-04-12T06:12:20Z")

</div>

Hi,

How about this.

```auto
input { stdin {},
  user => logstash_internal
  password => changeme
}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] 
  user => logstash_internal
  password => changeme
}
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 12, 2017, 6:29am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/11 "2017-04-12T06:29:36Z")

</div>

Why do you have a user and password in the input block? If Logstash is running, you should be able to curl its [monitoring API](https://www.elastic.co/guide/en/logstash/current/monitoring.html) on port 9600 to verify that it is up and running.

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 7:06am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/12 "2017-04-12T07:06:28Z")

</div>

Hi Christian,

When I run the conf this is the output.  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/3/33b3e3cd70651108a9ce6918f1348ec984defe73.png)

Also, this is my new conf file since you mentioned that it doesn't need user and pw.

```auto
input { stdin { }}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] }
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 12, 2017, 7:49am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/13 "2017-04-12T07:49:21Z")

</div>

Please do not post images of text as it can be hard to read.

---

<div class="post-metadata">

**Author:** ![arianayay](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@arianayay](https://discuss.elastic.co/u/arianayay)\
**Post date:** [April 12, 2017, 8:16am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/14 "2017-04-12T08:16:35Z")

</div>

Hi,

It stating **bad UR** I if i run bin/logstash -f mypipeline.conf

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2017, 8:19am UTC](https://discuss.elastic.co/t/cannot-monitor-logstash/81957/15 "2017-05-10T08:19:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.