# Stack Monitoring with Metricbeat 8 -- No Cluster Found

**URL:** <https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring\
**Created:** [June 15, 2023, 1:48pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104 "2023-06-15T13:48:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [June 15, 2023, 1:48pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/1 "2023-06-15T13:48:31Z")

</div>

Kibana cannot find stack monitoring data when using Metricbeat to collect Elasticsearch/Kibana/Logstash metrics on 8.x

I have the below configurations:

**Kibana (8.8.0)**  
No explicit settings in regards to monitoring etc.

**Elasticsearch (8.8.1)**

```auto
GET /_cluster/settings
{
  "persistent": {
    "xpack": {
      "monitoring": {
        "elasticsearch": {
          "collection": {
            "enabled": "true"
          }
        },
        "collection": {
          "enabled": "false"
        }
      }
    }
  }
}

```

**Metricbeat (8.8.1)**:

```auto
    - module: kubernetes
      metricsets:
        - event
      period: 10s
    - module: beat
      period: 10s
      hosts: ["http://localhost:5066"]
      xpack.enabled: true
    - hosts:
      - http://elasticsearch-client.default:9200
      metricsets:
      - cluster_stats
      - node
      - node_stats
      - index
      - index_recovery
      - index_summary
      - pending_stats
      - shard
      module: elasticsearch
      period: 10s
      scope: cluster
      xpack.enabled: true
    - enabled: true
      hosts:
      - http://kibana-ui.default:5601
      module: kibana
      period: 10s
      xpack.enabled: true

```

(I have also tried emitting `metricsets` entirely on the `elasticsearch` module.

I can see metricbeat is writing data to the relevant monitoring indices as I would expect:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83b96aa40777f9c0df235b7af6957c46f6348bde.jpeg)

However, Kibana doesn't seem the monitoring data:

```auto
Error: Unable to find the cluster in the selected time range. UUID: 4JH7KXiPTd-yk6aXxJ5sxA

```

I've observed from Kibana's debug logs (`monitoring.ui.debug_mode`) that Kibana is executing the below query when looking for monitoring data which is returning zero results:

```auto
POST *:.monitoring-es-*,.monitoring-es-*,*:metrics-elasticsearch.stack_monitoring.cluster_stats-*,metrics-elasticsearch.stack_monitoring.cluster_stats-*/_search
{
    "query": {
        "bool": {
            "filter": [
                {
                    "bool": {
                        "should": [
                            {
                                "term": {
                                    "data_stream.dataset": "elasticsearch.stack_monitoring.cluster_stats"
                                }
                            },
                            {
                                "term": {
                                    "metricset.name": "cluster_stats"
                                }
                            },
                            {
                                "term": {
                                    "type": "cluster_stats"
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "collapse": {
        "field": "cluster_uuid"
    },
    "sort": {
        "timestamp": {
            "order": "desc",
            "unmapped_type": "long"
        }
    }
}

```

Looking at the data in the `.monitoring-es-8-mb`, none of the documents contain any of the fields in the filter query above.

If I set `xpack.monitoring.collection.enabled` to `true` I get monitoring data for Elasticsearch (but this is through the legacy collection method which I thought was actually deprecated in 8.x), but does not solve the issue for the Kibana, Logstash, Beats etc. stack monitoring

---

<div class="post-metadata">

**Author:** ![ramdas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdas/32/110363_2.png) [@ramdas](https://discuss.elastic.co/u/ramdas)\
**Post date:** [July 10, 2023, 9:31am UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/2 "2023-07-10T09:31:25Z")

</div>

Thanks @Evesy for detailed debugging of the issue, i have been struggling with it too. however no replies from community experts yet.

Hi @warkolm @eMitch @ingri.mahecha, pinging you to get your kind attention on this issue. can you please help us fix this?

---

<div class="post-metadata">

**Author:** ![eMitch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emitch/32/93607_2.png) [@eMitch](https://discuss.elastic.co/u/eMitch)\
**Post date:** [July 10, 2023, 9:02pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/3 "2023-07-10T21:02:21Z")

</div>

@Evesy - can you verify that at least one of the nodes in the cluster has the Ingest role assigned to it?

```auto
GET _cat/nodes?v

```

look for `node.role` and make sure you see an `i`

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [July 14, 2023, 10:01am UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/4 "2023-07-14T10:01:02Z")

</div>

Hi @eMitch -- Apologies for the delayed response. We have a number of ingest nodes in the cluster as you can see below:

```auto
10.178.5.4 18 98 27 4.10 3.98 4.43 hirs - elasticsearch-data-hot-4
10.178.14.4 44 97 1 0.54 0.97 0.88 irtw - elasticsearch-data-warm-1
10.178.6.3 71 100 34 5.75 4.12 3.73 hirs - elasticsearch-data-hot-2
10.178.0.9 64 83 6 0.87 0.67 0.42 m * elasticsearch-master-2
10.178.13.4 33 99 47 4.99 4.29 4.26 hirs - elasticsearch-data-hot-1
10.178.7.4 51 96 0 0.06 0.14 0.29 irtw - elasticsearch-data-warm-4
10.178.3.16 40 82 8 1.07 0.79 0.58 m - elasticsearch-master-0
10.178.8.3 23 97 1 0.21 0.24 0.41 irtw - elasticsearch-data-warm-2
10.178.2.3 47 100 23 3.22 3.69 4.04 hirs - elasticsearch-data-hot-3
10.178.11.3 30 98 1 0.54 0.63 0.68 irtw - elasticsearch-data-warm-3
10.178.9.3 57 97 1 0.14 0.20 0.42 irtw - elasticsearch-data-warm-0
10.178.4.4 20 90 32 6.13 6.16 5.51 hirs - elasticsearch-data-hot-0
10.178.10.8 17 82 1 0.22 0.35 0.40 m - elasticsearch-master-1
10.178.12.4 46 96 1 0.30 0.31 0.45 irtw - elasticsearch-data-warm-6
10.178.15.4 58 94 1 0.02 0.11 0.37 irtw - elasticsearch-data-warm-5

```

Please let me know any other information I can provide

---

<div class="post-metadata">

**Author:** ![ingri.mahecha](https://avatars.discourse-cdn.com/v4/letter/i/51bf81/32.png) [@ingri.mahecha](https://discuss.elastic.co/u/ingri.mahecha)\
**Post date:** [July 17, 2023, 4:52pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/5 "2023-07-17T16:52:38Z")

</div>

Hello, verifying I do not see that you have configured the nodes, I leave you a reference URL [Running Metricbeat on master nodes](https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html#_running_metricbeat_on_master_nodes)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2023, 4:53pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-metricbeat-8-no-cluster-found/336104/6 "2023-08-14T16:53:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
