# Monitoring a secure elasticsearch cluster with heartbeat

**URL:** <https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [October 4, 2019, 10:14am UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323 "2019-10-04T10:14:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 4, 2019, 10:14am UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/1 "2019-10-04T10:14:22Z")

</div>

Hello,  
I have a monitor on all my cluster nodes that monitors on port 9200.  
But after enabling security, the heartbeat cannot of course access ES.

What is the syntax for the monitor to login securely  
This is my current config

# Configure monitors inline

heartbeat.monitors:

- type: http  
name: "esnode01"  
id: "esnode01"  
urls: ["[http://esnode01:9200](http://esnode01:9200)"]  
schedule: '@every 10s'

I use the output plugin for logstash.

I preferr not to specify credentials in the config file, using keystores for logstash and kibana for example. And my monitor account is very limited with permissions.

Can i configure this monitor to work for me when i require credentials.  
(have not activated https yet)

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [October 8, 2019, 2:32am UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/2 "2019-10-08T02:32:47Z")

</div>

You can use the [heartbeat keystore](https://www.elastic.co/guide/en/beats/heartbeat/current/keystore.html) for this. Once that's setup you can interpolate the password variables where you wish, just using a url like `https://user:pass@mycluster:9200`.

---

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 8, 2019, 11:15am UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/3 "2019-10-08T11:15:23Z")

</div>

Thanks Andrew, this is how i solved the monitor, together with the keystore  
heartbeat.monitors:

- type: http  
name: "esnode01"  
id: "esnode01"  
urls: ["[https://esnode01.domain.com:9200](https://esnode01.domain.com:9200)"]  
username: "username"  
password: "password"  
ssl.certificate\_authorities: "C:\Program Files\Heartbeat\elastic-stack-ca.crt"  
schedule: '@every 10s'

---

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 8, 2019, 12:05pm UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/4 "2019-10-08T12:05:19Z")

</div>

If i create the keystore entries called ES\_USER and ES\_PWD and reference them in the heartbeat.yml like this:  
  
username: "${ES\_USER}"

password: "${ES\_PWD}"

I get this error complaining on the first row:  
2019-10-08T14:00:51.925+0200 ERROR instance/beat.go:877 Exiting: could not create monitor: job err missing field accessing 'heartbeat.monitors.0.username' (source:'C:\Program Files\Heartbeat\heartbeat.yml')

if i remove the first variable with a static username and let the password be left i get an error on the next row:  
2019-10-08T14:04:52.351+0200 ERROR instance/beat.go:877 Exiting: could not create monitor: job err missing field accessing 'heartbeat.monitors.0.password' (source:'C:\Program Files\Heartbeat\heartbeat.yml')

So the variables for heartbeat dont seem to get read.

---

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [October 8, 2019, 12:13pm UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/5 "2019-10-08T12:13:16Z")

</div>

> [@Maekee](#):
>
> job err missing field accessing

If i start heartbeat like this below.. it seems to work, but then i dont get any logging from heartbeat!!!

heartbeat.exe -e -c heartbeat.yml

this is the default starting command line for heartbeat in windows:  
"C:\Program Files\Heartbeat\heartbeat.exe" -c "C:\Program Files\Heartbeat\heartbeat.yml" -path.home "C:\Program Files\Heartbeat" -path.data "C:\ProgramData\heartbeat" -path.logs "C:\ProgramData\heartbeat\logs" -E logging.files.redirect\_stderr=true

heartbeat -?  
-e, --e Log to stderr and disable syslog/file output

So can i have logging AND use variables?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2019, 12:22pm UTC](https://discuss.elastic.co/t/monitoring-a-secure-elasticsearch-cluster-with-heartbeat/202323/6 "2019-11-05T12:22:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.