Filebeat monitoring problem


(Павел Шевцов) #1

I tried to enable filebeat monitoring on elasticsearch.
Enabled it in the configuration:
xpack.monitoring:
enabled: true
elasticsearch:
hosts: ["http://10.10.8.77:9200"]
Thus configured 8 servers. But in kibana I see only 2.
The remaining logs from these servers are transmitted normally.
In the index .monitoring-beats- * I see data from all 8.
What could be the problem?

P.S.
Licensed on elasticsearch - basic.
Version elasticsearch and kibana - 6.4.2.
The filebeat version is 6.4.0.

P.P.S.
In ealsticsearch cluster - i have next settings
"persistent": {
"xpack": {
"monitoring": {
"collection": {
"enabled": "true"
}
}
}
},


(Andrew Cholakian) #2

Where in Kibana do you only see the 2? You said that the indices have the data, but it sounds like some view doesn't show it. Is that correct?


(Павел Шевцов) #3

I created a .monitoring-beat- * index. In it, I see data from all servers.
But I always see only two servers in the monitoring section. (And at the same time different).


(Andrew Cholakian) #4

Is anything, on the beats side, looking amiss in the logs? Any errors present?


(Павел Шевцов) #5

No. Not present any erros messages in filebeat log's.
And even more - all the logs from these hosts are transferred without problems.


(Andrew Cholakian) #6

So, out of curiosity, have you tried connecting those instances to a local Elasticsearch / Kibana installation?

This scenario is quite perplexing. With no errors, there's not much to follow-up on here. Let's see if we can get things working in some sense, then work backward to a cause.


(Павел Шевцов) #7

Currently my ELK cluster is collecting logs from about> 200 servers. I had no problems with the collection and processing of data. Problems are only the display of information in kibana with monitoring filebeat. To begin, I set up data collection from 8 servers. But as you can see information is displayed only from 2 of 8. And the most interesting is that these servers are different all the time.


(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.