# Send Filebeat Internal Monitoring Via Logstash
**URL:** https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468
**Category:** Beats
**Tags:** elastic-stack-monitoring, filebeat
**Created:** [November 17, 2021, 3:24pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468 "2021-11-17T15:24:26Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jceddy](https://discuss.elastic.co/u/jceddy)
#### Post date: [November 17, 2021, 3:24pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/1 "2021-11-17T15:24:26Z")
Basic question:
Is there a way to configure Filebeat Internal Monitoring via Logstash? I am trying to add monitoring for Filebeat running on some external systems, but can only send it via Logstash (not directly to Elasticsearch on the Monitoring cluster).
I haven't been able to track down an example of how to configure this.
Is it as easy as just settings monitoring.Elasticsearch.hosts to point at a Logstash instance instead of an Elasticsearch instance?
---
### Author:  [@matschaffer](https://discuss.elastic.co/u/matschaffer)
#### Post date: [November 18, 2021, 7:18am UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/2 "2021-11-18T07:18:12Z")
Hi Joseph,
Sending filebeat internal monitoring via logstash is not supported. I don't suspect pointing the monitoring ES setting at a logstash input would work.
You'd probably have a better chance of monitoring filebeat with a metricbeat process set up to send data to a beats input on the logstash instance.
However I don't recommend this since there's some extra complication from having logstash between beats and ES.
Depending on how you have logstash configured, the data could get written in a way that the stack monitoring UI doesn't know how to read.
---
### Author:  [@jceddy](https://discuss.elastic.co/u/jceddy)
#### Post date: [November 18, 2021, 9:05pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/3 "2021-11-18T21:05:04Z")
Thanks, I ended up being able to set it up to go directly to the ES monitoring cluster.
Due to a misconfiguration while testing, I have like 280 .monitoring documents with null cluster\_uuid...is there an easy way to remove those, or update that field to the actual cluster\_uuid?
---
### Author:  [@matschaffer](https://discuss.elastic.co/u/matschaffer)
#### Post date: [November 19, 2021, 1:35am UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/4 "2021-11-19T01:35:35Z")
Great that you were able to go directly to ES, Joseph!
You can use [Update By Query API | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html) if all the documents should have the same cluster uuid, [Delete by query API | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html) if you just want to delete them, or since it's only 280 docs, you could just leave them there and let index rotation roll them off eventually.
They probably take up very little space.
---
### Author:  [@jceddy](https://discuss.elastic.co/u/jceddy)
#### Post date: [November 19, 2021, 2:22pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/5 "2021-11-19T14:22:00Z")
Yeah, I'll probably just let them rotate out.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2021, 4:22pm UTC](https://discuss.elastic.co/t/send-filebeat-internal-monitoring-via-logstash/289468/6 "2021-12-17T16:22:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.