# To which type of elasticsearch node should I send x-pack messages (from Elasticsearch, Logstash, Kibana, and Beats), and normal messages (from Logstash)?

**URL:** <https://discuss.elastic.co/t/to-which-type-of-elasticsearch-node-should-i-send-x-pack-messages-from-elasticsearch-logstash-kibana-and-beats-and-normal-messages-from-logstash/250096>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [September 27, 2020, 5:03pm UTC](https://discuss.elastic.co/t/to-which-type-of-elasticsearch-node-should-i-send-x-pack-messages-from-elasticsearch-logstash-kibana-and-beats-and-normal-messages-from-logstash/250096 "2020-09-27T17:03:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [September 27, 2020, 5:03pm UTC](https://discuss.elastic.co/t/to-which-type-of-elasticsearch-node-should-i-send-x-pack-messages-from-elasticsearch-logstash-kibana-and-beats-and-normal-messages-from-logstash/250096/1 "2020-09-27T17:03:47Z")

</div>

Hi folks,

I am using Elastic Stack 7.9, and I have 11 VMs like below;

**1** - Elasticsearch Client Node (also injest) + Kibana  
**2,3** - Elasticsearch Master Nodes  
**4** - Elasticsearch Voting-only Master Node  
**5,6,7** - Elasticsearch Data Nodes  
**8,9** - Logstash Nodes  
**10,11** - Filebeats

I would like to monitor all these nodes using x-pack monitoring, so that I can see the health, whether the instance is up / not etc. But, here I don't have a separate monitoring cluster, and thus I cannot proceed with Metricbeat based monitoring as explained here [https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-overview.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-overview.html)

I have two doubts;

1. I would like to monitor all the above nodes, and which IPs should be mentioned in the `xpack.monitoring.elasticsearch.hosts` setting? For example here [https://www.elastic.co/guide/en/logstash/current/monitoring-internal-collection-legacy.html](https://www.elastic.co/guide/en/logstash/current/monitoring-internal-collection-legacy.html) you can see the configuration of x-pack in Logstash (showing _Deprecated in 7.9.0_, is it because I am not using another monitoring cluster?)

2. I am exporting logs from Filebeat to Kafka topic, and from there to Elasticsearch using Logstash. Currently, I have configured data node IPs in the `output` -\> `elasticsearch` section, and data is coming in Elasticsearch. So, is it correct to mention data nodes as Elasticsearch output of Logstash, or is it some other node that has to be mentioned there?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2020, 5:03pm UTC](https://discuss.elastic.co/t/to-which-type-of-elasticsearch-node-should-i-send-x-pack-messages-from-elasticsearch-logstash-kibana-and-beats-and-normal-messages-from-logstash/250096/2 "2020-10-25T17:03:59Z")

</div>

Closed on October 25, 2020, 5:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.