# How to monitor two servers with Metricbeat? **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [May 7, 2019, 7:52pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052 "2019-05-07T19:52:09Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 7, 2019, 7:52pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/1 "2019-05-07T19:52:10Z")
I have a two servers : - SERVER\_1 with ELK ([https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-18-04](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-18-04)) ELK is accessible from a subdomain and protected with a Nginx password. - SERVER\_2 with my Drupal site I configured Elasticsearch : `$ sudo nano /etc/elasticsearch/elasticsearch.yml` _I replaced the line_ `#network.host: 192.168.0.1` _by_ `network.host: localhost` On SERVER\_1 I installed Metricbeat with the following commands : `$ sudo apt install metricbeat` `$ sudo metricbeat modules enable system` `$ sudo metricbeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'` `$ sudo metricbeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'] -E setup.kibana.host=localhost:5601` `$ sudo systemctl start metricbeat` `$ sudo systemctl enable metricbeat` `$ curl -XGET 'http://localhost:9200/metricbeat-*/_search?pretty'` It works and I have the metrics in Kibana πŸ™‚ I created an SSL certificate : `$ sudo mkdir -p /etc/pki/tls/certs` `$ sudo mkdir /etc/pki/tls/private` `$ sudo nano /etc/ssl/openssl.cnf` [v3\_ca] subjectAltName = IP: IP\_SERVER\_1 `$ cd /etc/pki/tls` `$ sudo openssl req -config /etc/ssl/openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:4096 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt` I opened port 9200 on the firewall : `$ sudo ufw allow 9200` On SERVER\_2 I installed Metricbeat with the following commands : `$ sudo scp -r -p root@IP_SERVER_1:/etc/pki/tls/certs/logstash-forwarder.crt /etc/pki/tls/certs` `$ sudo apt install metricbeat` `$ sudo metricbeat modules enable system` `$ sudo nano /etc/metricbeat/metricbeat.yml` _I replaced the line_ `output.elasticsearch:` `# Array of hosts to connect to.` `hosts: ["localhost:9200"]` _by_ `output.elasticsearch:` `# Array of hosts to connect to.` `hosts: ["IP_SERVER_1:9200"]` `$ sudo systemctl start metricbeat` `$ sudo systemctl enable metricbeat` **Can not run SERVER\_2 metrics** ---
**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Post date:** [May 7, 2019, 10:23pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/2 "2019-05-07T22:23:47Z")
Instead of localhost, you have to write server address where Elasticsearch is installed. ---
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 7, 2019, 10:27pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/3 "2019-05-07T22:27:21Z")
Logstash, Kibana and Elasticsearch are installed on SERVER\_1. Which configuration file are you talking about ? ---
**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Post date:** [May 7, 2019, 10:42pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/4 "2019-05-07T22:42:22Z")
Oh. I think he has donethat already. I meant metricbeat.yml of remote server ---
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 7, 2019, 10:45pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/5 "2019-05-07T22:45:09Z")
OK for this file there is currently ES IP and port. It's not correct ? ---
**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Post date:** [May 7, 2019, 11:05pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/6 "2019-05-07T23:05:09Z")
Your configuration looks correct. What error/output you get while running on remote server? ---
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 7, 2019, 11:08pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/7 "2019-05-07T23:08:03Z")
If I was on IP 56.78.147.236 it redirects to [monitoring.example.com](http://monitoring.example.com) and displays Kibana. If I go on 56.78.147.236:9200 it says "Site inaccessible". Is this normal ? Here is the state of the firewall on the ELK server : To Action From * * * 22/tcp ALLOW IN Anywhere 80,443/tcp (Nginx Full) ALLOW IN Anywhere 5044 ALLOW IN Anywhere 9200 ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) 80,443/tcp (Nginx Full (v6)) ALLOW IN Anywhere (v6) 5044 (v6) ALLOW IN Anywhere (v6) 9200 (v6) ALLOW IN Anywhere (v6) ubuntu@www-example-com ~ $ sudo systemctl status metricbeat ● metricbeat.service - Metricbeat is a lightweight shipper for metrics. Loaded: loaded (/lib/systemd/system/metricbeat.service; disabled; vendor preset: enabled) Active: active (running) since Wed 2019-05-08 01:09:05 CEST; 14s ago Docs: [https://www.elastic.co/products/beats/metricbeat](https://www.elastic.co/products/beats/metricbeat) Main PID: 15581 (metricbeat) Tasks: 11 (limit: 4915) CGroup: /system.slice/metricbeat.service └─15581 /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml -path.home /usr/share/metricbeat -path.config / May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.979+0200 INFO instance/beat.go:391 metricbeat st May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.980+0200 INFO filesystem/filesystem.go:57 Ignori May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.980+0200 INFO fsstat/fsstat.go:59 Ignoring files May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.981+0200 INFO [monitoring] log/log.go:117 May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.981+0200 INFO cfgfile/reload.go:150 Config reloa May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.982+0200 INFO filesystem/filesystem.go:57 Ignori May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.982+0200 INFO fsstat/fsstat.go:59 Ignoring files May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.982+0200 INFO cfgfile/reload.go:205 Loading of c May 08 01:09:06 www-example-com metricbeat[15581]: 2019-05-08T01:09:06.733+0200 INFO add\_cloud\_metadata/add\_cloud\_metadata.go: May 08 01:09:07 www-example-com metricbeat[15581]: 2019-05-08T01:09:07.734+0200 INFO pipeline/output.go:95 Connecting t May 08 01:09:05 www-example-com metricbeat[15581]: 2019-05-08T01:09:05.982+0200 INFO cfgfile/reload.go:205 Loading of c May 08 01:09:06 www-example-com metricbeat[15581]: 2019-05-08T01:09:06.733+0200 INFO add\_cloud\_metadata/add\_cloud\_metadata.go: May 08 01:09:07 www-example-com metricbeat[15581]: 2019-05-08T01:09:07.734+0200 INFO pipeline/output.go:95 Connecting t May 08 01:09:35 www-example-com metricbeat[15581]: 2019-05-08T01:09:35.984+0200 INFO [monitoring] log/log.go:144 May 08 01:10:05 www-example-com metricbeat[15581]: 2019-05-08T01:10:05.984+0200 INFO [monitoring] log/log.go:144 May 08 01:10:35 www-example-com metricbeat[15581]: 2019-05-08T01:10:35.986+0200 INFO [monitoring] log/log.go:144 May 08 01:10:39 www-example-com metricbeat[15581]: 2019-05-08T01:10:39.577+0200 ERROR pipeline/output.go:100 Failed to May 08 01:10:39 www-example-com metricbeat[15581]: 2019-05-08T01:10:39.579+0200 INFO pipeline/output.go:93 Attempting t May 08 01:11:05 www-example-com metricbeat[15581]: 2019-05-08T01:11:05.986+0200 INFO [monitoring] log/log.go:144 May 08 01:11:35 www-example-com metricbeat[15581]: 2019-05-08T01:11:35.983+0200 INFO [monitoring] log/log.go:144 ---
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 7, 2019, 11:46pm UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/8 "2019-05-07T23:46:05Z")
I downloaded the SSL certificate on SERVER\_2, what do I do? πŸ™‚ ---
**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Post date:** [May 8, 2019, 3:06am UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/9 "2019-05-08T03:06:15Z")
[https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html) ---
**Author:** ![zenimagine](https://avatars.discourse-cdn.com/v4/letter/z/3bc359/32.png) [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Post date:** [May 8, 2019, 3:52am UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/10 "2019-05-08T03:52:27Z")
I read the documentation, why do you need 3 files? While I already created these 3 files on SERVER\_1 and I downloaded `/etc/pki/tls/certs/logstash-forwarder.crt` on SERVER\_2 For example, in this tutorial (for Filebeat) there is only one file for the client server : > **[How To Install Elasticsearch, Logstash, and Kibana (ELK Stack) on Ubuntu 14.04...](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04)** > > In this tutorial, we will go over the installation of the Elasticsearch ELK Stack on Ubuntu 14.04β€”that is, Elasticsearch 2.2.x, Logstash 2.2.x, and Kibana 4.4.x. We will also show you how to configure it to gather and visualize the syslogs of your... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 5, 2019, 3:52am UTC](https://discuss.elastic.co/t/how-to-monitor-two-servers-with-metricbeat/180052/11 "2019-06-05T03:52:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.