# Metricbeat doesn't monitor all instances

**URL:** https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321
**Category:** Beats
**Tags:** metricbeat
**Created:** [January 3, 2022, 7:58am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321 "2022-01-03T07:58:47Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)
#### Post date: [January 3, 2022, 7:58am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321/1 "2022-01-03T07:58:47Z")

</div>

Hi dears  
I have 3 instances of Logstash, and a Metricbeat (on another server)  
The problem is Metricbeat just shows one of the Logstash instances in "Stack Monitoring"

The relative config of `logstash.yml`  
node 1:

```auto
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
http.port: 9601

```

node 2:

```auto
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
http.port: 9602

```

node 3:

```auto
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
http.port: 9603

```

The `logstash-xpack.yml` in Metricbeat is:

```auto
# Module: logstash
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.6/metricbeat-module-logstash.html

- module: logstash
  metricsets:
    - node
    - node_stats
  period: 10s
  hosts: ["http://node3:9603","http://node1:9601","http://node2:9602"]
  username: "elastic"
  password: "MY_PASSWORD"
  xpack.enabled: true

```

But I can see just one of the instances in Kibana:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3bacda4d3b7ce326d49478c4e1f8d1fd263182ea.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b983cc2df4680273e8ed3038e2e1f1281c9d672a.png)

Could you please guide me?

---

<div class="post-metadata">

### Author: ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)
#### Post date: [January 3, 2022, 8:09am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321/2 "2022-01-03T08:09:29Z")

</div>

One more thing...

I use `tcpdump` to capture the traffic between the nodes. For example, this is request of Metricbeat and node1:

```auto
11:12:00.303975 IP 172.22.44.186.9601 > 172.22.44.185.35456: tcp 106
E.....@.@.....!...!.%......e.........0.....
.]..Ue.YHTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
Content-Length: 4209

```

But the request between Metricbeat and node 2 is:

```auto
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
11:14:10.269754 IP 172.22.44.185.37430 > 172.22.44.187.9602: tcp 0
!e.......r.8@.........%.
Ug..............J..a....<...
11:14:10.270139 IP 172.22.44.185.37440 > 172.22.44.187.9602: tcp 0
E..<|e@.@."...!...!..@%.U..h......r.V..........
........................
11:14:20.270197 IP 172.22.44.185.37490 > 172.22.44.187.9602: tcp 0
E..<..@.@.....!...!..r%...k.......r..6.........
Ug..............T..a..!.<...
11:14:20.270661 IP 172.22.44.185.37508 > 172.22.44.187.9602: tcp 0
E..<a.@.@.>...!...!...%..y.
......r..>.........
Ug..........................
11:14:30.269834 IP 172.22.44.185.37552 > 172.22.44.187.9602: tcp 0
E..<.1@.@.....!...!...%.zw........r............
Ug.,............^..a.1..<...
11:14:30.270021 IP 172.22.44.185.37560 > 172.22.44.187.9602: tcp 0
E..<..@.@..G..!...!...%...$.......r.X..........
Ug.-........................
11:14:40.269495 IP 172.22.44.185.37622 > 172.22.44.187.9602: tcp 0
E..<.M@.@.....!...!...%...wq......r.!..........
Ug.<............h..a.|..<...
11:14:40.269647 IP 172.22.44.185.37634 > 172.22.44.187.9602: tcp 0
E..<d.@.@.:...!...!...%..t........r............
Ug.<........................

```

When I `telnet` node1 with port `9601` it's ok, but I get `telnet: connect to address (IP): No route to host` for two others  
This is weird! Because every node can ping each other and they are in a cluster (every node do its work correctly and there is no network problem)

---

<div class="post-metadata">

### Author: ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)
#### Post date: [January 3, 2022, 8:52am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321/3 "2022-01-03T08:52:37Z")

</div>

The problem solved

I add an INPUT chain with `iptables`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 31, 2022, 10:53am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-monitor-all-instances/293321/4 "2022-01-31T10:53:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.