# Logstash Monitoring API -
**URL:** https://discuss.elastic.co/t/logstash-monitoring-api/213286
**Category:** Logstash
**Tags:** elastic-stack-monitoring
**Created:** [December 29, 2019, 3:11pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286 "2019-12-29T15:11:34Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [December 29, 2019, 3:11pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/1 "2019-12-29T15:11:34Z")
Hi Guys!
i have 3 logstash servers installed for my data pipeline.
i have enabled the xpack.monitoring for each one of the servers, when i use Kibana and go to "Monitoring" tab, i see only one instance although i have 3.
each time i ran refresh i see another logstash instance, logstash version:6.8.
i have tried already to check if there is any content under /usr/share/logstash/data directory
but it was empty of context.
Any advice?
Thanks,
Gidi
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 30, 2019, 4:08pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/2 "2019-12-30T16:08:49Z")
Hi @Gidi_Kalef,
> each time i ran refresh i see another logstash instance
So for example, if you have logstash instances A, B, C, you're saying that every time you refresh, you see either A _or_ B _or_ C? But not all three?
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [December 30, 2019, 4:28pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/3 "2019-12-30T16:28:27Z")
yes! exactly
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 30, 2019, 4:41pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/4 "2019-12-30T16:41:21Z")
Do you recall how you setup each logstash instance? Did you fresh install them all? Or did you copy/paste from one to the other?
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [December 30, 2019, 4:59pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/5 "2019-12-30T16:59:50Z")
I have cloned the machines
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 30, 2019, 5:03pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/6 "2019-12-30T17:03:04Z")
You probably have duplicated uuids across all logstash instances. We have [this enhancement request](https://github.com/elastic/kibana/issues/18263) to improve this in the UI, but for now, you'll need to manually remove the `logstash/data/uuid` file (logstash should recreate this on restart) for each logstash instance and restart each one.
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [December 30, 2019, 5:35pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/7 "2019-12-30T17:35:26Z")
can you please refer me to the relative path?
I have already checked /usr/share/logstash/data and there is no such a file.
thanks.!
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 31, 2019, 11:51am UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/8 "2019-12-31T11:51:55Z")
Ah, it's possible that file doesn't exist in your version (`6.8`). Are you able to safely delete the `data/` directory?
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [December 31, 2019, 1:00pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/9 "2019-12-31T13:00:14Z")
yes I'm able, so I should delete /usr/share/logstash/data dir?
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 31, 2019, 7:28pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/10 "2019-12-31T19:28:49Z")
Yes, try deleting them and seeing if that fixes the issue
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [January 1, 2020, 9:49am UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/11 "2020-01-01T09:49:58Z")
> [@chrisronline](#):
>
> try deleting them and seeing if t
Unfortunately, it doesnt helps ☹
Is there another suggestions?
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [January 2, 2020, 6:35pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/12 "2020-01-02T18:35:22Z")
Hmm.
Try running this query against the monitoring cluster and report back the results:
```auto
POST .monitoring-logstash-*/_search
{
"size": 10,
"query": {
"bool": {
"filter": [
{
"range": {
"timestamp": {
"gte": "now-15m"
}
}
},
{
"term": {
"type": {
"value": "logstash_stats"
}
}
}
]
}
},
"collapse": {
"field": "logstash_stats.logstash.uuid"
}
}
```
---
### Author:  [@tomj](https://discuss.elastic.co/u/tomj)
#### Post date: [January 2, 2020, 7:29pm UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/13 "2020-01-02T19:29:39Z")
I had a similar problem a while back and got good advice here along the same lines.
I was generating AMIs and starting them on AWS EC2, so I implemented this "user data" script that runs when each Logstash instance starts.
```
#!/bin/bash
# In order for Elastic Cloud to be able to monitor more than one Logstash host, the UUIDs must be unique
# across all Logstash hosts which are feeding a given Elasticsearch cluster.
# https://discuss.elastic.co/t/x-pack-monitoring-shows-one-of-all-of-the-configured-logstash-nodes/142760
# The file /var/lib/logstash/uuid must be created on instance startup, before logstash is started.
# Deleting /var/lib/logstash/uuid at the time the AMI is generated is ineffective, because it is not
# generated until Logstash starts for the first time.
UUID=`uuidgen | tr -d "\n\r" `
echo "generated Logstash UUID ${UUID}"
echo -n ${UUID} > /var/lib/logstash/uuid
chown logstash:logstash /var/lib/logstash/uuid
echo "wrote Logstash UUID to file /var/lib/logstash/uuid"
```
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [January 5, 2020, 8:46am UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/14 "2020-01-05T08:46:59Z")
@chrisronline
Hi ,
i have founded the soultion thanks to @tomj ,
i have looked in the wrong path, i had should looked for in /var/lib/logstash and i have searched under /usr/share/logstash/data instead
Thanks everyone!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2020, 8:47am UTC](https://discuss.elastic.co/t/logstash-monitoring-api/213286/15 "2020-02-02T08:47:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.