# Metricbeat writing to .ds-metricbeat instead of .ds-.monitoring

**URL:** https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798
**Category:** Beats
**Tags:** metricbeat
**Created:** [February 21, 2024, 2:45pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798 "2024-02-21T14:45:10Z")
**Posts on this page:** 12
**Page:** 3

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:01pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/41 "2024-02-21T19:01:40Z")

</div>

Also

```auto
/usr/bin/metricbeat test modules

elasticsearch...
  ccr...
    error... ERROR timeout waiting for an event
  enrich...
    error... ERROR timeout waiting for an event
  cluster_stats...
    error... ERROR timeout waiting for an event
  index...
    error... ERROR timeout waiting for an event
  index_recovery...
    error... ERROR timeout waiting for an event
  index_summary...
    error... ERROR timeout waiting for an event
  ml_job...
    error... ERROR timeout waiting for an event
  node_stats...OK

  shard...
    error... ERROR timeout waiting for an event
kibana...
  stats...OK

  cluster_rules...OK

  node_rules...OK

  node_actions...OK

system...
  cpu...OK

  load...OK

  memory...OK

  network...OK

  process...OK

  process_summary...OK

  socket_summary...OK

system...
  filesystem...OK

  fsstat...OK

system...
  uptime...OK

```

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 7:05pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/42 "2024-02-21T19:05:33Z")

</div>

check for any extra .yml files in the module directory... they all get concatenated together...

Weird ... you have some issues there ... Ohh node stats ok

Wierd but I would expect shards index etc to all be good

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:07pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/43 "2024-02-21T19:07:06Z")

</div>

Logs from the new basic elastic cluster are showing up in the .ds-.monitoring-es-8-mb-2024.02.21-006828 index now! The new cluster still is not showing in Stack Monitoring though

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 7:10pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/44 "2024-02-21T19:10:58Z")

</div>

What License to you have?  
On both clusters?  
Multi-monitoring Cluster requires a commercial License  
^^^ this is highly likely an issue..

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:14pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/45 "2024-02-21T19:14:12Z")

</div>

> [@stephenb](#):
>
> Multi-monitoring Cluster requires a commercial License

We have a Platinum license on our monitoring cluster and a Basic license on the new cluster I am trying to monitor.

I actually just saw the new elastic cluster pop up in Stack Monitoring of our monitoring cluster and when I tried to click on it it showed this error

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a539ce296bd61278d320ee6edda9da800da959c.png)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 7:15pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/46 "2024-02-21T19:15:11Z")

</div>

> [@6igwig](#):
>
> We have a Platinum license on our monitoring cluster and a Basic license on the new cluster I am trying to monitor.

Yup if you turn a trial and reload the page and restart the metricbeat it should show up...

I just tested that and got the same results... enabled trial and it worked

But yeah they all need licenses if you are going to configure that way

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:16pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/47 "2024-02-21T19:16:11Z")

</div>

The elasticbase cluster did not show up in Stack Monitoring of the monitoring cluster until I changed the scope in elasticsearch-xpack.yml to "cluster" and specified both elastic hosts in the hosts parameter.

New elasticsearch-xpack.yml:

```auto
# Module: elasticsearch
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.10/metricbeat-module-elasticsearch.html

- module: elasticsearch
  xpack.enabled: true
  metricsets:
    - node
    - node_stats
    - cluster_stats
    - enrich
    - index
    - index_recovery
    - index_summary
    - ingest_pipeline
    - pending_tasks
    - shard
    - ml_job
  period: 10s
  hosts: ["https://elasticbase1.mynetwork.com:9200","https://elasticbase2.mynetwork.com:9200"]
  scope: cluster
  username: "remote_monitoring_user"
  password: "${remote_monitoring_password}"  
  ssl:
    enabled: true
    verification_mode: "certificate"

```

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:17pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/48 "2024-02-21T19:17:37Z")

</div>

Thank you so much for your help dogging this out @stephenb!!

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 21, 2024, 7:18pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/49 "2024-02-21T19:18:22Z")

</div>

> [@6igwig](#):
>
> The elasticbase cluster did not show up in Stack Monitoring of the monitoring cluster until I changed the scope in elasticsearch-xpack.yml to "cluster" and specified both elastic hosts in the hosts parameter.

Yes make sense... I asked you earlier if you were putting on each node / cluster etc...

But that is all good ... but now you have the license issue.... that will be an issue.

You need to apply a license to the base cluster or self-monitor or monitor to a single monitoring cluster those are your choices

---

<div class="post-metadata">

### Author: ![6igwig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6igwig/32/88971_2.png) [@6igwig](https://discuss.elastic.co/u/6igwig)
#### Post date: [February 21, 2024, 7:20pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/50 "2024-02-21T19:20:45Z")

</div>

> [@stephenb](#):
>
> You need to apply a license to the base cluster or self-monitor or monitor to a single monitoring cluster those are your choices

Understood! I'll have to think about these options. Really wish I could just monitor with our existing monitoring cluster ☹

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 21, 2024, 8:12pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/51 "2024-02-21T20:12:47Z")

</div>

> [@stephenb](#):
>
> You need to apply a license to the base cluster or self-monitor or monitor to a single monitoring cluster those are your choices

That's what I mentioned earlier, the documentation could be more clear, it says that a License is required, but it does not say that both cluster needs to have a license.

I assumed that because this is how it works for other licensed features like CCR.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2024, 10:13pm UTC](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798/52 "2024-03-20T22:13:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/metricbeat-writing-to-ds-metricbeat-instead-of-ds-monitoring/353798.md?page=2)
