# Metricbeat writing to .ds-metricbeat instead of .ds-.monitoring
**URL:** https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798
**Category:** Beats
**Tags:** metricbeat
**Created:** [February 21, 2024, 2:45pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798 "2024-02-21T14:45:10Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 4:45pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/21 "2024-02-21T16:45:50Z")
> That is a problem
Yes, this error was resolved by elevating privileges of elastic.output user and specifying the kibana host.
Now the output of the setup command is not showing any errors. I ran it with the -e flag after specifying `setup.ilm.overwrite: true` in the `metricbeat.yml` file.
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 4:46pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/22 "2024-02-21T16:46:56Z")
output of `/usr/bin/metricbeat setup`:
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 5:03pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/23 "2024-02-21T17:03:50Z")
So, is it still writing to the wrong index?
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:06pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/24 "2024-02-21T18:06:20Z")
Yes it is.
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:08pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/25 "2024-02-21T18:08:44Z")
There is actually monitoring data showing up in Stack Monitoring of the new cluster. But it is not showing up in the Stack Monitoring of the monitoring cluster..
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:08pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/26 "2024-02-21T18:08:56Z")
Delete the indices / data streams
Run Setup again
Try Again
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:09pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/27 "2024-02-21T18:09:27Z")
which indices / data streams should I delete?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:10pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/28 "2024-02-21T18:10:10Z")
> [@6igwig](#):
>
> There is actually monitoring data showing up in Stack Monitoring of the new cluster. But it is not showing up in the Stack Monitoring of the monitoring cluster..
Your output section need to point to the monitoring cluster
```auto
output.elasticsearch:
hosts: ["https://xxx:9200"]
username: "metricbeat_monitoring_writer"
password: "${metricbeat_monitoring_password}"
ssl:
verification_mode: "certificate"
```
That needs to be the monitoring cluster... sounds like it is pointing at the Source Cluster
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:10pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/29 "2024-02-21T18:10:50Z")
> Your output section need to point to the monitoring cluster
it is outputting to the monitoring cluster.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:11pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/30 "2024-02-21T18:11:19Z")
It can not be... there is no way the data could go back to the source cluster... unless it is pointed there
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:14pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/31 "2024-02-21T18:14:02Z")
> [@stephenb](#):
>
> It can not be... there is no way the data could go back to the source cluster... unless it is pointed there
Here is my metricbeat.yml config
```auto
output.elasticsearch:
hosts: ["https://esmonitor1.mynetwork.com:9200"]
username: "metricbeat_monitoring_writer"
password: "${metricbeat_monitoring_password}"
ssl:
verification_mode: "certificate"
```
My new elastic servers are [elasticbase1.mynetwork.com](http://elasticbase1.mynetwork.com) and [elasticbase2.mynetworkts.com](http://elasticbase2.mynetworkts.com)
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:15pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/32 "2024-02-21T18:15:37Z")
do you have the system module enabled? is it sending to the monitoring cluster.
There is something basic... are you sure you are accessing the correct metricbeat.yml
you can use the -c option from command line
Do you have CCS Setup?
Something basic... keep looking
run
`metricbeat -c /full/path/metricbeat.yml -e -d "*"`
and look for the connection information etc
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:26pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/33 "2024-02-21T18:26:39Z")
> [@stephenb](#):
>
> do you have the system module enabled? is it sending to the monitoring cluster.
I do **not** have the system module enabled.
> Do you have CCS Setup?
I do not have cross cluster search enabled.
> run `metricbeat -c /full/path/metricbeat.yml -e -d "*"`
My config is at `/etc/metricbeat/metricbeat.yml`
Here is a log related to connection
```auto
{"log.level":"info","@timestamp":"2024-02-21T13:25:43.402-0500","log.logger":"publisher_pipeline_output","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run","file.name":"pipeline/client_worker.go","file.line":145},"message":"Connection to backoff(elasticsearch(https://esmonitor1.mynetwork.com:9200)) established","service.name":"metricbeat","ecs.version":"1.6.0"}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:31pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/34 "2024-02-21T18:31:03Z")
Something Basic going on
> **[Collecting Elasticsearch monitoring data with Metricbeat | Elasticsearch...](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-metricbeat.html)**
Enable the system module see if the system data shows up in the monitoring cluster
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:33pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/35 "2024-02-21T18:33:50Z")
> [@6igwig](#):
>
> ```auto
> # Module: elasticsearch
> # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-elasticsearch.html
>
> ```
```auto
# Module: elasticsearch
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-elasticsearch.html
```
What version of metricbeat?
Why are you not using metricbeat 8.12.1... are you really using 7.10 that could be the problem... but your index names look like 8.12.1...
You have been upgrading?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:37pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/36 "2024-02-21T18:37:33Z")
Just download metricbeat 8.12.1 tar.gz un tar it... and configure and run in the foreground... that is what I would do
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:37pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/37 "2024-02-21T18:37:54Z")
> [@stephenb](#):
>
> Enable the system module see if the system data shows up in the monitoring cluster
I have enabled the system module by renaming `/etc/metricbeat/modules.d/system.yml.down` to `/etc/metricbeat/modules.d/system.yml`
confirmed system module is loaded:
`/usr/bin/metricbeat modules list`
returned:
```auto
Enabled:
elasticsearch
kibana-xpack
system
Disabled:
activemq
aerospike
airflow
apache
appsearch
aws
awsfargate
azure
beat
beat-xpack
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 6:39pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/38 "2024-02-21T18:39:32Z")
> [@6igwig](#):
>
> /etc/metricbeat/modules.d/system.yml.down
You should be using (But I think they are basically the same) just looking for reasons
```auto
$ ./metricbeat modules list
Enabled:
elasticsearch-xpack <---- HERE
system
Disabled:
activemq
```
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:50pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/39 "2024-02-21T18:50:05Z")
> [@stephenb](#):
>
> You should be using
Done!
```auto
/usr/bin/metricbeat modules list
Enabled:
elasticsearch-xpack
kibana-xpack
system
Disabled:
activemq
aerospike
airflow
apache
```
---
### Author:  [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 6:51pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/40 "2024-02-21T18:51:58Z")
Also
```auto
/usr/bin/metricbeat test output
elasticsearch: https://esmonitor1.mynetwork.com:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: **monitoring cluster's ip**
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 8.12.1
```
[Previous page](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798.md?page=1)
[Next page](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798.md?page=3)