# Filebeat creates a "Standalone Cluster" in Kibana Monitoring

**URL:** https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663
**Category:** Beats
**Tags:** elastic-stack-monitoring, filebeat
**Created:** [July 3, 2019, 9:19am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663 "2019-07-03T09:19:10Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Christophe\_Journel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christophe_journel/32/12534_2.png) [@Christophe\_Journel](https://discuss.elastic.co/u/Christophe_Journel)
#### Post date: [July 3, 2019, 9:19am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/1 "2019-07-03T09:19:10Z")

</div>

Hello,

I have a whole ELK stack which is perfectly functionnal on production.  
However, i'm trying (with 7.2.0) to get metrics from filebeat.

The problem is: It creates a new "cluster" in Kibana Monitoring page : "Standalone Cluster"

I tried to delete /var/lib/filebeat/\*, but i can make the filebeat to join my real production cluster.

Here is the configuration

monitoring:  
enabled: true  
elasticsearch:  
hosts: ["host1:9200","host2:9200"]  
username: remote\_monitoring\_user  
password: xxxxxxxxxxxxxxxx

Thanks,

---

<div class="post-metadata">

### Author: ![DennisLoos](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@DennisLoos](https://discuss.elastic.co/u/DennisLoos)
#### Post date: [July 3, 2019, 9:54am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/2 "2019-07-03T09:54:19Z")

</div>

I have the same behaviour with a similar configuration after upgrading the cluster and Beats to 7.2.0

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 3, 2019, 10:19am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/3 "2019-07-03T10:19:04Z")

</div>

Hi @Christophe_Journel and @DennisLoos,

In 7.2, we allowed Filebeat to ship its monitoring data directly to a Monitoring Elasticsearch cluster (which might be separate from your Production Elasticsearch cluster, where you send the log data being harvested by Filebeat). The new `monitoring.*` settings introduced in 7.2 let you set the Monitoring cluster for Filebeat.

Now, if your `output` is `elasticsearch`, then we **know** which Elasticsearch cluster your Filebeat is sending its logs data to. In that case the Monitoring UI can correctly associate the Filebeat instance with that Elasticsearch cluster.

However, if the `output` is something other than `elasticsearch`, we cannot know if the logs data is ending up in an Elasticsearch cluster. So the Monitoring UI shows the Filebeat instance in a "Standalone Cluster".

---

<div class="post-metadata">

### Author: ![DennisLoos](https://avatars.discourse-cdn.com/v4/letter/d/73ab20/32.png) [@DennisLoos](https://discuss.elastic.co/u/DennisLoos)
#### Post date: [July 3, 2019, 10:50am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/4 "2019-07-03T10:50:11Z")

</div>

Hi Shaunak,

In my case, that's exactly what is happening. My output is sent to logstash for grokking and the monitoring is send to the Elasticsearch cluster. I have 3 Beats that have output to Elasticsearch and they appear in the cluster monitoring info.

Is there a way to connect them to the right cluster in the filebeat configuration or otherwise ?  
That would also eliminate the cluster choice when opening monitoring.

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 3, 2019, 11:07am UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/5 "2019-07-03T11:07:00Z")

</div>

As a **temporary** workaround, you can go back to using the deprecated `xpack.monitoring.*` settings (instead of the new `monitoring.*` ones). However, please note that the `xpack.monitoring.*` settings will eventually go away in a future major version.

---

<div class="post-metadata">

### Author: ![ThomasMarcelis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasmarcelis/32/49788_2.png) [@ThomasMarcelis](https://discuss.elastic.co/u/ThomasMarcelis)
#### Post date: [July 10, 2019, 1:18pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/6 "2019-07-10T13:18:24Z")

</div>

Hi Shaunak,

I also have the exact same scenario here. Are there plans for a permanent fix or workaround in the future?

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [July 10, 2019, 1:30pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/7 "2019-07-10T13:30:34Z")

</div>

Hi @ThomasMarcelis,

Yes, we're discussing various options. Once we have a clear direction, I'll post a link to a GitHub issue/PR here so you can follow along.

Shaunak

---

<div class="post-metadata">

### Author: ![sergiodcm00](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sergiodcm00](https://discuss.elastic.co/u/sergiodcm00)
#### Post date: [July 31, 2019, 7:35pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/8 "2019-07-31T19:35:37Z")

</div>

I have the same problem.

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [August 6, 2019, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/9 "2019-08-06T19:20:41Z")

</div>

I just put up a PR for a proposed solution here: [https://github.com/elastic/beats/pull/13182](https://github.com/elastic/beats/pull/13182).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2019, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-creates-a-standalone-cluster-in-kibana-monitoring/188663/10 "2019-09-03T19:20:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
