# Limit es monitored data in metricbeat

**URL:** https://discuss.elastic.co/t/limit-es-monitored-data-in-metricbeat/381160
**Category:** Metrics
**Tags:** elastic-stack-monitoring
**Created:** [August 20, 2025, 10:45am UTC](https://discuss.elastic.co/t/limit-es-monitored-data-in-metricbeat/381160 "2025-08-20T10:45:17Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)
#### Post date: [August 20, 2025, 10:45am UTC](https://discuss.elastic.co/t/limit-es-monitored-data-in-metricbeat/381160/1 "2025-08-20T10:45:17Z")

</div>

Hello,

I’m currently monitoring ELK stack through metricbeat (Elasticsearch, Kibana & Logstash)  
but the monitoring index for Elasticsearch “ **.ds-.monitoring-es** …….” is around 15GB per day so I switched the period to 60 seconds instead of 10, but I think the size of the index is way to big compared to the data provided.

So my question is, how do I limit the info monitored by Metricbeat without losing essential data?  
I tried to inspect the index and found out that most of the fields are empty.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47f5ef6e2dd2c6f2d32623872d391defd4435015.png)

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [August 21, 2025, 3:48am UTC](https://discuss.elastic.co/t/limit-es-monitored-data-in-metricbeat/381160/2 "2025-08-21T03:48:35Z")

</div>

Hello @SamehSaeed

Could you please share the number of nodes in your cluster for which this monitoring is enabled along with 1 of the dummy \<metricbeat.yml \> as to see what all modules as enabled.

Also share the output for below query via devtools :

```auto
GET _cat/indices/.ds-.monitoring-es*?v&s=store.size:desc

```

Thanks!!

---

<div class="post-metadata">

### Author: ![SamehSaeed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samehsaeed/32/145262_2.png) [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)
#### Post date: [August 21, 2025, 6:47am UTC](https://discuss.elastic.co/t/limit-es-monitored-data-in-metricbeat/381160/3 "2025-08-21T06:47:36Z")

</div>

Hello, thank you for your reply

I have only one node

metricbeat.yml :

```auto
metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true

  # Period on which files under path should be checked for changes
  reload.period: 60s

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

name: " ****"

logging.level: error

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

output.elasticsearch:

  hosts: ["https:// ****:****"]
  protocol: "https"
  username: "remote_monitoring_user"
  password: " ****"
  ssl.certificate_authorities: [" ****"]
  ssl.verification_mode: certificate

  preset: balanced
  
  setup.kibana:
  host: "https:// ****:****"

```

elasticsearch-xpack.yml :

```auto
# Module: elasticsearch
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/8.x/metricbeat-module-elasticsearch.html

- module: elasticsearch
  xpack.enabled: true
  period: 60s
  hosts: ["https:// ****:****"]
  username: "elastic"
  password: " *****"
  ssl.verification_mode: "none"
  scope: node
  metricsets:
    - node
#api_key: "foo:bar"

```

GET \_cat/indices/.ds-.monitoring-es\*?v&s=store.size:desc :

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open .ds-.monitoring-es-8-mb-2025.08.19-000197 dO4fIXr8TsGBlygeNEN4fg 1 0 24154649 0 14.9gb 14.9gb 14.9gb
green open .ds-.monitoring-es-8-mb-2025.08.20-000199 aByXutjDTFO5OuykEsSt7g 1 0 5169566 0 3.1gb 3.1gb 3.1gb

```

.ds-.monitoring-es-8-mb-2025.08.20-000199 is much smaller because the period is set to 60s