# Logstash monitoring not working properly **URL:** \ **Category:** Logstash\ **Created:** [September 26, 2017, 2:55pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874 "2017-09-26T14:55:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 2:55pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/1 "2017-09-26T14:55:49Z")
Hello, I am not sure which category I should use for this thread but since it is monitoring related I will use X-Pack. So I have 4 Logstash 5.6.1 instances running and 5 Elasticsearch 5.6.1 nodes all running X-Pack 5.6.1... Now in Kibana monitoring I can only see 2 Logstash instances although in reality all 4 are running perfectly fine without any errors. But then this gets really weird. The instance Nr. 1 is always shown in Kibana monitoring but the rest are just iterating through each other on each page reload. So it means that all 4 instances are being monitored but somehow only 2 can be displayed in Kibana at the same time so it just cycles through the instances for the second spot. Any suggestions? 😃 What I tied so far: 1. Deleting the Logstash monitoring index. 2. xpack.monitoring.elasticsearch.url option set from array to a single Elasticsearch data node. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 3:03pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/2 "2017-09-26T15:03:50Z")
How did you install Logstash? ---
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 3:10pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/3 "2017-09-26T15:10:11Z")
Offline debian package. At first I was using Logstash 5.2.2 without X-Pack but now I upgraded to Logstash 5.6.1 and installed X-Pack. Note that everything was done offline because it is an isolated cluster. ---
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 3:13pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/4 "2017-09-26T15:13:29Z")
Also I checked all the documents in the Logstash monitoring index and everything looks OK. All 4 instances appear in the index as they should so to me it looks more and more like Kibana issue. ---
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 3:24pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/5 "2017-09-26T15:24:00Z")
Ah I think I see the problem. I checked the monitoring index again and its strange because the instance Nr. 1 has unique "uuid": "12dab77e-a7f6-4560-93d4-be249d47b08a" and the other three have the same "uuid": "6bacfeba-4955-43fc-863d-75c37a94ec7a". Could this be it? And if so why and how did this happen... ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 3:26pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/6 "2017-09-26T15:26:11Z")
That was what I was looking for. I think UUID is generated on installation. Did you install Logstash on each machine or clone the directory/machine image for some of them? ---
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 3:29pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/7 "2017-09-26T15:29:33Z")
Now that is a good question. Sadly I was not the one who did the initial installation. All I know is that 2 instances were setup at first and 2 were added later. So I am pretty sure they might have cloned the instance Nr.2 when adding 2 new ones... ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 26, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/8 "2017-09-26T15:33:50Z")
That would explain it... ---
**Author:** ![Mr.Flakes](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mr.Flakes](https://discuss.elastic.co/u/Mr.Flakes)\ **Post date:** [September 26, 2017, 3:39pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/9 "2017-09-26T15:39:11Z")
Now I have a feeling that there is no way to change the uuid without performing a full reinstall? 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 24, 2017, 3:39pm UTC](https://discuss.elastic.co/t/logstash-monitoring-not-working-properly/101874/10 "2017-10-24T15:39:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.