# Filebeat monitoring problem

**URL:** https://discuss.elastic.co/t/filebeat-monitoring-problem/154278
**Category:** Beats
**Tags:** filebeat
**Created:** [October 27, 2018, 8:53am UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278 "2018-10-27T08:53:00Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)
#### Post date: [October 27, 2018, 8:53am UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/1 "2018-10-27T08:53:00Z")

</div>

I tried to enable filebeat monitoring on elasticsearch.  
Enabled it in the configuration:  
xpack.monitoring:  
enabled: true  
elasticsearch:  
hosts: ["[http://10.10.8.77:9200](http://10.10.8.77:9200)"]  
Thus configured 8 servers. But in kibana I see only 2.  
The remaining logs from these servers are transmitted normally.  
In the index .monitoring-beats- \* I see data from all 8.  
What could be the problem?

P.S.  
Licensed on elasticsearch - basic.  
Version elasticsearch and kibana - 6.4.2.  
The filebeat version is 6.4.0.

P.P.S.  
In ealsticsearch cluster - i have next settings  
"persistent": {  
"xpack": {  
"monitoring": {  
"collection": {  
"enabled": "true"  
}  
}  
}  
},

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [November 1, 2018, 5:36pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/2 "2018-11-01T17:36:23Z")

</div>

Where in Kibana do you only see the 2? You said that the indices have the data, but it sounds like some view doesn't show it. Is that correct?

---

<div class="post-metadata">

### Author: ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)
#### Post date: [November 1, 2018, 6:05pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/3 "2018-11-01T18:05:33Z")

</div>

I created a .monitoring-beat- \* index. In it, I see data from all servers.  
But I always see only two servers in the monitoring section. (And at the same time different).

 ![filebeat](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f3310968b097ac43202a4ad7e431281a401e96b.jpeg)

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [November 1, 2018, 7:43pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/4 "2018-11-01T19:43:52Z")

</div>

Is anything, on the beats side, looking amiss in the logs? Any errors present?

---

<div class="post-metadata">

### Author: ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)
#### Post date: [November 2, 2018, 5:37pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/5 "2018-11-02T17:37:50Z")

</div>

No. Not present any erros messages in filebeat log's.  
And even more - all the logs from these hosts are transferred without problems.

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [November 2, 2018, 8:58pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/6 "2018-11-02T20:58:20Z")

</div>

So, out of curiosity, have you tried connecting those instances to a local Elasticsearch / Kibana installation?

This scenario is quite perplexing. With no errors, there's not much to follow-up on here. Let's see if we can get things working in some sense, then work backward to a cause.

---

<div class="post-metadata">

### Author: ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)
#### Post date: [November 3, 2018, 9:03am UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/7 "2018-11-03T09:03:20Z")

</div>

Currently my ELK cluster is collecting logs from about\> 200 servers. I had no problems with the collection and processing of data. Problems are only the display of information in kibana with monitoring filebeat. To begin, I set up data collection from 8 servers. But as you can see information is displayed only from 2 of 8. And the most interesting is that these servers are different all the time.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-monitoring-problem/154278/8 "2018-12-01T09:10:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
