# Monitoring Cluster stopped receiving data from Production Cluster
**URL:** https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876
**Category:** Beats
**Tags:** metricbeat
**Created:** [October 15, 2021, 10:16pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876 "2021-10-15T22:16:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)
#### Post date: [October 15, 2021, 10:16pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876/1 "2021-10-15T22:16:21Z")
#### Observations
- OS: Windows Sever 2019
- Observations are based on:
- When MetricBeat Agent encountered an error on the Elastic Node, it reports the error to the Monitoring Cluster.
- The message is stored in the index “metribeat-7.15.0”. (Note: Base on the mapping, it is not making use of the default metricbeat template)
- When the agent created a new index, it encounters the following errors (as captured in the log file)
- The Monitor cluster stops receiving metrics from the agent.
- Delete the index “metribeat-7.15.0” , (Restart Metricbeat Agent) and Monitor Cluster will resume collecting metrics.
#### Hypothesis
- When Metricbeat setup the default index template. The default index lifecycle write alias name is “metricbeat-%{[agent.version]}" = “metricbeat-7.15.0".
- This alias crashes with the index created when Metricbeat encounters an error. This stops the agent from writing to the Monitoring Cluster.
- It is likely that when the agent was writing the error, the index name wasn’t specify properly (i.e. the date math portion may be missing), it should be metribeat-%{[agent.version]}-%{+yyyy.MM.dd} instead of metribeat-%{[agent.version]}
#### Questions
- Is the hypothesis correct in stating that a default configuration somewhere (minor bug) needs to be updated?
- As a workaround, is there somewhere I can specify the index name for the agent to use when writing error messages?
- Finally, I may be completely wrong, what may be the other causes or explanation?
**Thanks for any helps or feedbacks**
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [October 16, 2021, 3:43pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876/2 "2021-10-16T15:43:52Z")
Take a look at this post I suspect you perhaps may be in the same situation.
> [@Metricbeat not creating Index correctly](https://discuss.elastic.co/t/metricbeat-not-creating-index-correctly/285863/3):
>
> So when you did that you deleted the write alias metricbeat-7.13.4 as well besides the actual indexes with the data in it. You don't want to do that. When you initially ran setup the metricbeat-7.13.4 write alias was created it looked something like this you can read about them [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/aliases.html#write-index). They are part of ILM. running setup will re-create it. "metricbeat-7.13.4-2021.10.07-000001" : { "aliases" : { "metricbeat-7.13.4" : { "is\_write\_index" : true } When working properly, …
---
### Author:  [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)
#### Post date: [October 18, 2021, 5:03pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876/3 "2021-10-18T17:03:59Z")
Thanks Stephen, great explanations. You are right that I am in similar situation.
Right down to the facts that I need to shutdown all instances of the Metricbeat agents before deleting the incorrect index.
As usual I have proven to the community how little I know.
Now that I know “Why”, it’s time to figure out how it happens! (I have a feeling someone is going to own me lunch.)
Thanks again!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2021, 7:04pm UTC](https://discuss.elastic.co/t/monitoring-cluster-stopped-receiving-data-from-production-cluster/286876/4 "2021-11-15T19:04:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.