Cluster name in monitoring data

We are using a monitoring cluster to monitor multiple elastic clusters. I'm trying to write a query to check all the nodes of a given cluster name, but not sure which property in .monitoring indice would provide me with the info. I was looking at cluster_uuid, but I would prefer using a valid cluster name viz. cluster.name setting as in elasticsearch.yml file.

Any help on how to get this from .monitoring indice would be helpful.

Dear All,

Checking as I didn't get any advice. Trying to get cluster name from monitoring data (indices). Thanks for the help.

Hi Karthik,

The cluster name is in cluster_state type, along with the node name:

One easy of finding this out would be to add an index pattern for .monitoring-es-* and then you can look at the fields in discover.

Thanks,
Bhavya

Hi Bhavya,

I believe it is cluster_stats as I see the entry there, and couldn't find any entry for cluster_state type. Regardless, I'm not able to query (filter) by cluster_name as it is a dynamic field (=> using cluster_name in term/terms filter of query doesn't get me any data),

In template (.monitoring...es) dynamic is set to false though!

Below is what i see in the template.
"cluster_stats": {
"properties": {
"nodes": {
"type": "object"
},
"indices": {
"type": "object"
}
}
}

My goal is to find cluster_uuid based on input cluster name and chain it to node_stats to find all the nodes of a cluster in a watcher input.

Hi, which version of Elasticsearch and Kibana are you using? I think it was for v5.5 that we deprecated the cluster_stats type and merged its data into the cluster_state type.

Hi Tim

We are using 6.1, and in process of moving to 6.2

Since cluster_name is not available in all data, I have to create two aggregations now and group by uuid. Say If I want to get JVM usage data by cluster/node (assuming multiple clusters are monitored) I have to get data from two places

Yes, that is correct. That is what Kibana Monitoring application does in several areas.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.