# Cannot see the production cluster data on the monitoring cluster

**URL:** <https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [April 15, 2024, 11:27am UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422 "2024-04-15T11:27:04Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 15, 2024, 11:27am UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/1 "2024-04-15T11:27:04Z")

</div>

Hi there! I've 2 elk clusters version 7.6.1 "Basic license", 1st -production which have 3nodes (elastic, kibana, logstash and metricbeat agents on each node) and 2nd - monitoring cluster which have 1 node (elastic, kibana, metricbeat agent)

the question is: can i see all the nodes from my production cluster on my monitoring cluster which have own kibana instance with "Basic license" ?  
thanks!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 15, 2024, 12:20pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/2 "2024-04-15T12:20:21Z")

</div>

You can monitor your production cluster with another monitoring cluster, you need to use metricbeat and configure it to send data to your monitoring cluster.

But you cannot self-monitoring your monitoring cluster as the basic license does not allow monitoring multiple clusters.

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 15, 2024, 12:49pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/3 "2024-04-15T12:49:06Z")

</div>

ok! i got it, but what is the right way to achieve this ? I've re-read all the docs several times, but still cannot see the nodes in my kibana on monitoring cluster side

i follow the instructions and setup the metricbeat on prod nodes cluster with the following lines:

```auto
  hosts: ["elk-mc.local:9200"] <--- url of my monitoring cluster
  username: "elastic"
  password: "my_password"
  protocol: "https"
  ssl.enabled: true
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/metricbeat/elastic-stack-ca-elk-mc.pem"]

```

- elasticsearch-xpack.yml with the following lines:

```auto
- module: elasticsearch
  metricsets:
    - ccr
    - cluster_stats
    - enrich
    - index
    - index_recovery
    - index_summary
    - ml_job
    - node_stats
    - shard
  period: 10s
  hosts: ["https://elk1.local:9200"] <--- first node of my prod cluster
  username: "elastic"
  password: "my_password"
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/metricbeat/elastic-stack-ca.pem"]
  xpack.enabled: true

```

the index named metricbeat-7.6.1-2024.04.15-000001 was created by elastic on monitoring cluster, but there aren't any data  
and "No monitoring data found" in Kibana after I've disabled the self-monitoring.  
maybe I've missed something?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 15, 2024, 12:58pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/4 "2024-04-15T12:58:23Z")

</div>

Did you check this [part](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-elasticsearch.html#_usage_for_elastic_stack_monitoring_2) of the documentation?

> The `elasticsearch` module can be used to collect metrics shown in our Stack Monitoring UI in Kibana. To enable this usage, set `xpack.enabled: true` and **remove** any `metricsets` from the module’s configuration.

Try to remove the `metricsets` and add a the `scope` as _cluster_.

I have it working with this setting:

```auto
- module: elasticsearch
  xpack.enabled: true
  period: 15s
  scope: cluster
  hosts: ["https://PROD-MASTER:9200"]
  username: "USERNAME"
  password: "PASSWORD"
  ssl.enabled: true
  ssl.verification_mode: "none"
  ssl.certificate_authorities: ["/etc/elasticsearch/certs/ca/ca.crt"]

```

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 15, 2024, 1:58pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/5 "2024-04-15T13:58:55Z")

</div>

If config:

```auto

- module: elasticsearch
  metricsets:
    - node
    - node_stats
  period: 10s
  hosts: ["https://elk1.local:9200"]
  username: "elastic"
  password: "my_password"
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/metricbeat/elastic-stack-ca.pem"]
  scope: cluster
  xpack.enabled: true

```

I see in the output:  
Error creating runner from config: 1 error: The elasticsearch module with xpack.enabled: true must have metricsets: [ccr enrich cluster\_stats index index\_recovery index\_summary ml\_job node\_stats shard]

and...

If config:

```auto
- module: elasticsearch
  metricsets:
    - node
    - node_stats
  period: 10s
  hosts: ["https://elk1.local:9200"]
  username: "elastic"
  password: "my_password"
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/metricbeat/elastic-stack-ca.pem"]
  scope: cluster
  #xpack.enabled: true

```

I see new docs in the Discover section in Kibana from production node, but still no data in Stack Monitoring

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 15, 2024, 3:03pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/6 "2024-04-15T15:03:03Z")

</div>

> [@My\_Google\_Account](#):
>
> Error creating runner from config: 1 error: The elasticsearch module with xpack.enabled: true must have metricsets: [ccr enrich cluster\_stats index index\_recovery index\_summary ml\_job node\_stats shard]

Yeah, it seems that in 7.6 is different, you need to specify the metricsets.

7.6 is pretty old and not supported anymore.

What is the version of your monitoring cluster?

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 15, 2024, 3:07pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/7 "2024-04-15T15:07:39Z")

</div>

both versions are 7.6.1

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 16, 2024, 8:34am UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/8 "2024-04-16T08:34:38Z")

</div>

maybe is there one more module that should be enabled to send needed data to Monitoring stack UI ?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 16, 2024, 12:04pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/9 "2024-04-16T12:04:28Z")

</div>

> [@My\_Google\_Account](#):
>
> maybe is there one more module that should be enabled to send needed data to Monitoring stack UI ?

I don't think so, if the module that you want is already enabled, then you should have the data.

Just to confirm, you followed this [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/configuring-metricbeat.html)? Can you double check all the settings, including the cluster settings?

Not sure what is the issue, it may be some bug that was already fixed on later version. 7.6 is really old and not supported anymore.

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 17, 2024, 8:16am UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/12 "2024-04-17T08:16:44Z")

</div>

I've achieved my aim via update through update my monitoring cluster to 7.10.2 and metricbeat also to 7.10.2 versions.  
But now i came across with this problem: how can i disable the "monitoring-cluster" node and monitor only "myhome cluster" with my Basic license?

 ![scr1](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5fbbb449cabee81874b07f9a2f6d00ddbf225e76.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 17, 2024, 11:58am UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/13 "2024-04-17T11:58:30Z")

</div>

> [@leandrojmp](#):
>
> But you cannot self-monitoring your monitoring cluster as the basic license does not allow monitoring multiple clusters.

This is what I mentioned here, you have the self-monitoring for your monitoring cluster enabled.

You need to disable it, try to run this on your monitoring cluster:

```auto
PUT _cluster/settings
{
  "persistent": {
    "xpack.monitoring.collection.enabled": true
  }
}

```

Also, set `xpack.monitoring.enabled` in your monitoring cluster `elasticsearch.yml` to `false`.

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 17, 2024, 12:24pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/14 "2024-04-17T12:24:42Z")

</div>

set `xpack.monitoring.enabled` in your monitoring cluster `elasticsearch.yml` to `false` - Done

and my \_cluster/settings output:

```auto
{
  "persistent" : {
    "xpack" : {
      "monitoring" : {
        "elasticsearch" : {
          "collection" : {
            "enabled" : "true"
          }
        },
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  },
  "transient" : { }
}

```

is this correct?, i still cannot use myhome cluster

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 17, 2024, 12:30pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/15 "2024-04-17T12:30:31Z")

</div>

The setting `xpack.monitoring.elasticsearch.collection.enabled` needs to be set to `false` on your production cluster as well, this is mentioned in the end of the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/configuring-metricbeat.html).

```auto
PUT _cluster/settings
{
  "persistent": {
    "xpack.monitoring.elasticsearch.collection.enabled": false
  }
}

```

It should work, but I'm not sure if you will need to delete the data you have in your monitoring cluster.

As mentioned this version is pretty old, it is been years since I used it and some things changed on newer versions to make this process simpler.

---

<div class="post-metadata">

**Author:** ![My\_Google\_Account](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_google_account/32/55185_2.png) [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\
**Post date:** [April 17, 2024, 12:52pm UTC](https://discuss.elastic.co/t/cannot-see-the-production-cluster-data-on-the-monitoring-cluster/357422/16 "2024-04-17T12:52:48Z")

</div>

15 mins later it worked and in the Stack Monitoring Panel i've now only my prod cluster, and i see all my nodes, thank you so much!