In 7.2, we allowed Filebeat to ship its monitoring data directly to a Monitoring Elasticsearch cluster (which might be separate from your Production Elasticsearch cluster, where you send the log data being harvested by Filebeat). The new monitoring.* settings introduced in 7.2 let you set the Monitoring cluster for Filebeat.
Now, if your output is elasticsearch, then we know which Elasticsearch cluster your Filebeat is sending its logs data to. In that case the Monitoring UI can correctly associate the Filebeat instance with that Elasticsearch cluster.
However, if the output is something other than elasticsearch, we cannot know if the logs data is ending up in an Elasticsearch cluster. So the Monitoring UI shows the Filebeat instance in a "Standalone Cluster".
In my case, that's exactly what is happening. My output is sent to logstash for grokking and the monitoring is send to the Elasticsearch cluster. I have 3 Beats that have output to Elasticsearch and they appear in the cluster monitoring info.
Is there a way to connect them to the right cluster in the filebeat configuration or otherwise ?
That would also eliminate the cluster choice when opening monitoring.
As a temporary workaround, you can go back to using the deprecated xpack.monitoring.* settings (instead of the new monitoring.* ones). However, please note that the xpack.monitoring.* settings will eventually go away in a future major version.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.