` seems to contain all the needed data extracted by the metricbeat module.
Maybe this tells you anything?
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 8, 2020, 3:49pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-logstash-xpack-module-data-not-collected-and-not-sent-to-es/258006/6 "2020-12-08T15:49:31Z")
If you run in regular mode (lose the `-d` option), do you see messages like this in the Metricbeat server log file:
```auto
2020-12-08T10:48:48.304-0500 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":156,"time":{"ms":81}},"total":{"ticks":644,"time":{"ms":148},"value":644},"user":{"ticks":488,"time":{"ms":67}}},"info":{"ephemeral_id":"fe599f11-d5ad-40e6-943e-2f46c14721c6","uptime":{"ms":60047}},"memstats":{"gc_next":12526624,"memory_alloc":10234848,"memory_total":68773016,"rss":2220032},"runtime":{"goroutines":32}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":3,"batches":6,"duplicates":12,"total":15},"read":{"bytes":5982},"write":{"bytes":49807}},"pipeline":{"clients":2,"events":{"active":0,"published":15,"total":15},"queue":{"acked":15}}},"metricbeat":{"logstash":{"node":{"events":12,"success":12},"node_stats":{"events":3,"success":3}}},"system":{"load":{"1":8.5332,"15":17.4814,"5":23.2773,"norm":{"1":0.5333,"15":1.0926,"5":1.4548}}}}}}
```
If so, can you share them? They should appear every ~10s when new data is pushed to Elasticsearch.
---
### Author:  [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)
#### Post date: [December 8, 2020, 4:08pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-logstash-xpack-module-data-not-collected-and-not-sent-to-es/258006/7 "2020-12-08T16:08:31Z")
So apparently there is some issue with the built in `remote_monitoring_user` permissions for the `metricbeat-*` index.
I have manually added the `all` permission for `metricbeat-*` for the user through Kibana, restarted metricbeat and all of the sudden the missing logstash index was created and now Logstash appears in Stack Monitoring.
I guess something was missing and it couldn't create new indeces but that is weird since the ES and kibana indeces were created nontheless.
I have also manually added the `read_ilm` cluster privilege since metricbeat was complaining it could not retrieve the `ILM policy`, and also noticed repeating `...failed to check for alias 'metricbeat-7.7.0'... action [indeces:admin/aliases/get] is unauthorized for user`
Could you get someone on the Elastic team to look into that?
For me its not a big deal to leave it like that, but this is probably something that needs to be checked.
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [December 8, 2020, 6:18pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-logstash-xpack-module-data-not-collected-and-not-sent-to-es/258006/8 "2020-12-08T18:18:03Z")
The `-xpack` stack product modules (such as `logstash-xpack` and `elasticsearch-xpack`) do not index into `metricbeat-*`, but rather into custom, stack monitoring indices named `.monitoring-*`.
If you are seeing an issue with `metricbeat-*` indices, it must be due to another Metricbeat module (which, for you, looks like `system`).
Do you need the `system` module? If not, try disabling that and reverting the permission changes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2021, 6:18pm UTC](https://discuss.elastic.co/t/logstash-monitoring-with-metricbeat-logstash-xpack-module-data-not-collected-and-not-sent-to-es/258006/9 "2021-01-05T18:18:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.