# Metricbeat does not send documents to indices other than .monitoring-es-\*-mb, even when output.elasticsearch.index specified

**URL:** <https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, metricbeat\
**Created:** [June 29, 2022, 8:53pm UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516 "2022-06-29T20:53:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Olivia\_Anderson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olivia_anderson/32/99800_2.png) [@Olivia\_Anderson](https://discuss.elastic.co/u/Olivia_Anderson)\
**Post date:** [June 29, 2022, 8:53pm UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516/1 "2022-06-29T20:53:11Z")

</div>

I have 2 elasticsearch clusters deployed with ECK, and want to send stack monitoring data from the main cluster to the monitoring cluster. Metricbeat is setup with the following configs:

elasticsearch.yml:

```auto
- module: elasticsearch
  enabled: true
  metricsets:
    - ccr
    - cluster_stats
    - enrich
    - index
    - index_recovery
    - index_summary
    - ml_job
    - node_stats
    - shard
  period: 10s
  hosts: ["${MONITORED_ES_HOST}:${MONITORED_ES_PORT}"]
  username: "${MONITORED_ES_USERNAME}"
  password: "${MONITORED_ES_PASSWORD}"
  ssl.verification_mode: "none"
  xpack.enabled: true

```

metricbeat.yml

```auto
metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

processors:
  - add_cloud_metadata:

output.elasticsearch:
  hosts: ['${MONITORING_ES_HOST}:${MONITORING_ES_PORT}']
  username: ${MONITORING_ES_USERNAME}
  password: ${MONITORING_ES_PASSWORD}
  ssl.verification_mode: "none"

output.elasticsearch.index: "metricbeat-es-%%{[agent.version]}-%%{+yyyy.MM.dd}"
setup.template.name: "metricbeat-es"
setup.template.pattern: "metricbeat-es-*"
setup.ilm.enabled: false
logging.level: debug

```

The index template is loaded correctly, under the correct name, though data only flows into .monitoring-es-7-mb\* indices.

I've tried multiple versions of metricbeat (from 7.7.0-latest), and verified that the configuration is loading correctly with `metricbeat test config -e`, including `output.elasticsearch.index`. I've also tried using ECK to deploy metricbeat with autodiscover, and using a generic kubernetes deployment with no luck. The only time data was placed into the expected index was when I had mistyped the hostname of the main cluster and error logs were stored.

Is there a way to change the output index when using the elasticsearch module only?

---

<div class="post-metadata">

**Author:** ![matschaffer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matschaffer/32/95396_2.png) [@matschaffer](https://discuss.elastic.co/u/matschaffer)\
**Post date:** [July 4, 2022, 7:23am UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516/2 "2022-07-04T07:23:44Z")

</div>

This is the key configuration here.

> [@Olivia\_Anderson](#):
>
> `xpack.enabled: true`

That tells metricbeat to send data able to drive the "Stack Monitoring" UI in kibana. If you take that out you should be able to override the output index, but you won't be able to use the Stack Monitoring kibana application, you'll need to build your own visualisations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2022, 9:24am UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516/3 "2022-08-01T09:24:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.