Hi @Mary2022
I see a couple issues I think so lets back up a bit and will help clarify a few things I hope.
I am not sure if they are simple cut and past issues but there are a number of syntax / indentation issues with your files.
1st lets focus on monitoring logstash
Make sure you comment all this in the logstash yml
# xpack.monitoring.enabled: true
# xpack.monitoring.Elasticsearch.username: logstash_system
# xpack.monitoring.Elasticsearch.password: password
# xpack.monitoring.Elasticsearch.hosts: ["https://es-01:9200", "https://es-02:9200", "https://es-03:9200"]
# xpack.monitoring.Elasticsearch.ssl.certificate_authority: [ "/etc/pki/ca.crt" ]
# xpack.monitoring.Elasticsearch.ssl.keystore.path: /etc/pki/logstash.jks
# xpack.monitoring.Elasticsearch.ssl.keystore.password: password
# xpack.monitoring.Elasticsearch.ssl.verification_mode: certificate
# xpack.monitoring.Elasticsearch.sniffing: false
# xpack.monitoring.collection.interval: 10s
# xpack.monitoring.collection.pipeline.details.enabled: true
2nd the metricbeat.yml file should look like this... you will probably need to put fix ssl setting under the setup.kibana and output.elasticsearch settings once you get it working
#============================ Config Reloading ===============================
metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.period: 10s
reload.enabled: true
#======================Elasticsearch Template settings#=========================*
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
#===============================Kibana==================================*
setup.kibana:
# FIXED
host: ["https://kiba-01:5601","https://kiba-02:5601"]
# FIX AFTER YOU GET WORKING
ssl.verification_mode: "none"
#=======================Elasticsearch Output==================================
output.elasticsearch:
hosts: ["https://es-01:9200","https://es-02:9200",https://es-03:9200"]
protocol: "https"
username: "username"
password: "password"
# FIX AFTER YOU GET WORKING
ssl.verification_mode: "none"
#=============================Processors===============================
processors:
-add_host_metadata: ~
#=============================Logging======
# You had this incorrect logging.level=debug
logging.level: debug
#=============================X-Pack Monitoring==============================
# This self enables monitoring of this beat so you don't need the beats-xpack
monitoring.enabled: true
3rd remove / disable the beat-xpack.yml you do not need it and it is miss-configured.
4th your logstsash-xpack.yml should look like this.
Note I temporarily put it the ssl.verification_mode: "none" once you get it working you will need to put in the ssl information about the logstash ssl cert
- module: logstash
period: 10s
hosts: ["https://logstash-i01:9600","https://logstash-i02:9600"]
username: username
password: password
xpack.enabled: true
# FIX AFTER YOU GET WORKING
ssl.verification_mode: "none"
run setup and test again...
Let us know how it goes...
BIG NOTE you need / should to actually be monitoring Elasticsearch as well to see so also enable the elasticsearch-xpack module and get that running too....
Not sure if you did that or not...
- module: elasticsearch
xpack.enabled: true
period: 10s
hosts: ["https://localhost:9200"]
username: "elastic"
password: "sakdfjhsldfkjhasdf"
ssl.verification_mode : "none"
Using this... This is what I have now...
