# Monitoring Logstash using Metricbeat **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [January 3, 2022, 11:35am UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344 "2022-01-03T11:35:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Post date:** [January 3, 2022, 11:35am UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/1 "2022-01-03T11:35:46Z")
Hi, I have 3 instances of Logstash and want to monitor them in Kibana This is my `/etc/metricbeat/modules.d/logstash-xpack.yml` configuration: ```auto # Module: logstash # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.6/metricbeat-module-logstash.html - module: logstash metricsets: - node - node_stats period: 10s hosts: ["http://172.22.129.187:9603","http://172.22.33.186:9601","http://172.22.33.187:9602"] username: "elastic" password: "MY_PASSWORD" xpack.enabled: true ``` The `hhtp.port` for every instance of `logstash.yml` is 9601 , 9602 and 9603 And also the `logstash-xpack` module is enabled: `metricbeat modules enable logstash-xpack` The output of Elasticsearch in `metricbeat.yml` is all my 4 ES nodes on port 9200 I have all pipelines in "Stack Monitoring" (all pipelines of 3 instances of Logstash) But in Nodes section, I just see one instance of Logstash!!! ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2684ba0033c5a033cd62d1e42a770b61ad18174c.png) This is "Pipelines" section which included 3 instances of Logstash: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10bf0a98b78eb579cb87de6a4c132432b2f89106.png) The weird thing is sometime the name of only Logstash node that shown in "Nodes" changes to another instance name... For example in the first picture above, `elk-node101.software:9603` changes to `elk-node2.software:9601` automatically! Could you please help me about this? I'm using the stack on version 7.16.2 Kind regards ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [January 3, 2022, 11:57am UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/2 "2022-01-03T11:57:31Z")
Check the `node.name` in `logstash.yml` for each instance ---
**Author:** ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Post date:** [January 3, 2022, 12:21pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/3 "2022-01-03T12:21:51Z")
Thanks for your response I defined name for every Logstash instance. Now they have `node.name` in `logstash.yml` ```auto node.name: elk-lnx1.software http.host: 0.0.0.0 http.port: 9602 ``` ```auto node.name: elk-lnx2.software http.host: 0.0.0.0 http.port: 9601 ``` ```auto node.name: elk-lnx101.software http.host: 0.0.0.0 http.port: 9603 ``` But in "Nodes" there is just one instance: ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d46d4c5862cdb58ff228ae526371224562367c7.png) ---
**Author:** ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Post date:** [January 3, 2022, 12:27pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/4 "2022-01-03T12:27:40Z")
And if you see, in the last picture I have `elk-lnx1.software` but in the very first picture I had `elk-lnx101.software` It always changes regularly... ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 3, 2022, 1:13pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/5 "2022-01-03T13:13:03Z")
I'm not sure you can monitor 3 different instances this way. You should use one `.yml` file per host you want to monitor, or create multiple modules in the same `.yml` , each one pointing to a different logstash, If i'm not wrong using an array of hosts will work in a load balance way and not querying all the hosts at the same time. Try to edit your `.yml` to have something like this: ```auto - module: logstash metricsets: - node - node_stats period: 10s hosts: ["http://172.22.129.186:9601"] username: "elastic" password: "MY_PASSWORD" xpack.enabled: true - module: logstash metricsets: - node - node_stats period: 10s hosts: ["http://172.22.129.187:9602"] username: "elastic" password: "MY_PASSWORD" xpack.enabled: true - module: logstash metricsets: - node - node_stats period: 10s hosts: ["http://172.22.129.187:9603"] username: "elastic" password: "MY_PASSWORD" xpack.enabled: true ``` ---
**Author:** ![Farid\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farid_n/32/74144_2.png) [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Post date:** [January 3, 2022, 2:08pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/6 "2022-01-03T14:08:31Z")
Thanks for your response I edited `logstash-spack.yml` as you suggested. But unfortunately, that doesn't work. I have all of 3 instances' pipelines, but have just one random node... ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [January 3, 2022, 2:19pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/7 "2022-01-03T14:19:56Z")
The suggested solution by @leandrojmp should work I used to use this to monitor multiple instances of beats using the same beat.yml of metricbeat That should be the same for logstash ---
**Author:** ![eraste](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@eraste](https://discuss.elastic.co/u/eraste)\ **Post date:** [January 3, 2022, 2:44pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/9 "2022-01-03T14:44:04Z")
Metricbeat has two modules: logstash and logstash-xpack. So, 1- Enable logstash module : metricbeat modules enable logstash 2- Edit etc/metricbeat/modules.d/logstash.yml like this: - module: logstash metricsets: - node - node\_stats period: 10s hosts:["[http://172.22.129.187:9603](http://172.22.129.187:9603/)","[http://172.22.33.186:9601](http://172.22.33.186:9601/)","[http://172.22.33.187:9602](http://172.22.33.187:9602/)"] username: "elastic" password: "MY\_PASSWORD" ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 31, 2022, 4:44pm UTC](https://discuss.elastic.co/t/monitoring-logstash-using-metricbeat/293344/10 "2022-01-31T16:44:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.