Logstash monitoring is not enabled despite Helm values

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

Hello,

In my current ECK deployment (using the eck-stack chart), Logstash monitoring is not enabled, while Elasticsearch and Kibana monitoring are working as expected.

Current Logstash Configuration (Excerpt)

eck-logstash:
  enabled: true
  fullnameOverride: logstash
  count: 3
  elasticsearchRefs:
    - clusterName: elasticsearch-es
      name: elasticsearch
  monitoring:
    metrics:
      elasticsearchRefs:
        - name: elasticsearch
    logs:
      elasticsearchRefs:
        - name: elasticsearch
  config:
    pipeline.workers: 4
    log.level: debug
  pipelines:
    - pipeline.id: main
      config.string: |
        input {...}
        filter {...}
        output{...}

My Logstash Helm values reference monitoring.metrics.elasticsearchRefs and monitoring.logs.elasticsearchRefs, but the actual Logstash process configuration does not enable monitoring. The xpack.monitoring.enabled setting is missing or set to false in the Logstash configuration, as shown in the logs at startup :

[2026-04-22T12:14:00,157][DEBUG][logstash.runner          ] xpack.monitoring.allow_legacy_collection: false
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.enabled: false
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.elasticsearch.hosts: ["http://localhost:9200"]
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.collection.interval: TimeValue{duration=10, timeUnit=SECONDS}
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.collection.timeout_interval: TimeValue{duration=10, timeUnit=MINUTES}
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.elasticsearch.username: logstash_system
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.password: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.proxy: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.cloud_id: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.cloud_auth: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.api_key: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.certificate_authority: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.truststore.path: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.truststore.password: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.keystore.path: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.keystore.password: null
[2026-04-22T12:14:00,158][DEBUG][logstash.runner          ] xpack.monitoring.elasticsearch.ssl.verification_mode: full
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.certificate: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *xpack.monitoring.elasticsearch.ssl.key: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] xpack.monitoring.elasticsearch.ssl.cipher_suites: []
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] xpack.monitoring.elasticsearch.sniffing: false
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] xpack.monitoring.collection.pipeline.details.enabled: true
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] xpack.monitoring.collection.config.enabled: true
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] monitoring.enabled: false
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] monitoring.elasticsearch.hosts: ["http://localhost:9200"]
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] monitoring.collection.interval: TimeValue{duration=10, timeUnit=SECONDS}
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] monitoring.collection.timeout_interval: TimeValue{duration=10, timeUnit=MINUTES}
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] monitoring.elasticsearch.username: logstash_system
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.password: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.proxy: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.cloud_id: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.cloud_auth: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.api_key: null
[2026-04-22T12:14:00,159][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.certificate_authority: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.ca_trusted_fingerprint: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.truststore.path: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.truststore.password: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.keystore.path: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.keystore.password: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] monitoring.elasticsearch.ssl.verification_mode: full
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.certificate: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] *monitoring.elasticsearch.ssl.key: null
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] monitoring.elasticsearch.ssl.cipher_suites: []
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] monitoring.elasticsearch.sniffing: false
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] monitoring.collection.pipeline.details.enabled: true
[2026-04-22T12:14:00,160][DEBUG][logstash.runner          ] monitoring.collection.config.enabled: true

Can someone help please ?

2 
  monitoring:
    metrics:
      elasticsearchRefs:
        - name: elasticsearch

you sure elasticsearch is correct here?

Verify if you have a resource named elasticsearch by getting all kinds of elasticsearch resources: kubectl get elasticsearch

Normally the monitoring resource is called elasticsearch-monitoring

3

Thank you for your answer.
Indeed, elasticsearch is correct.

kubectl get elasticsearch -n kollog 
NAME            HEALTH   NODES   VERSION   PHASE   AGE
elasticsearch   green    3       9.3.0     Ready   35d

I configured fullnameOverride to elasticsearch.
I'm using the same reference for elasticsearch/kibana and it works :

eck-elasticsearch:
  enabled: true

  fullnameOverride: elasticsearch

  monitoring:
    metrics:
      elasticsearchRefs:
      - name: elasticsearch
    logs:
      elasticsearchRefs:
      - name: elasticsearch

[...]

eck-kibana:
  enabled: true

  fullnameOverride: kibana
  
  elasticsearchRef:
    name: elasticsearch

  monitoring:
    metrics:
      elasticsearchRefs:
      - name: elasticsearch
    logs:
      elasticsearchRefs:
      - name: elasticsearch
[...]