Traffic Filters and monitoring clusters

[adrian0 (Adrian)]

Hi,

Regarding Traffic FIlters in ES Cloud, the documentation reads the following:

This only applies to external traffic. Internal traffic is managed by Elasticsearch Service. For example, Kibana can connect to Elasticsearch, as well as internal services which manage the deployment. Other deployments can’t connect to deployments protected by traffic filters. Given the limitation, clusters used for monitoring, storing leader indices for cross-cluster replication or search across as part of cross-cluster search cannot be configured with traffic filters.

I'm currently testing this feature, and we have a dedicated monitoring cluster. Correct me if I'm wrong, but the documentation says that the monitoring cluster will not be able to monitor the production cluster, if the production cluster has traffic filters enabled?

If this is correct, then how come I can still see logs and monitoring data coming in from the production cluster, after activating a functional traffic filter?

What I did encounter was that Watcher alerts that used curl against the production cluster endpoint failed, but Alerting still works as it looks in the monitoring indecies rather than curling the production cluster health/stats API.

I hope someone can shed some light on this, or clarify the documentation in some way.

Greets,
Adrian M

[warkolm (Mark Walkom)]

Check out Enable logging and monitoring | Elasticsearch Service Documentation | Elastic

• Traffic filters can not be enabled on monitoring deployments at this time. If you are shipping your logs or metrics to a monitoring deployment, do not associate traffic filters with the Elasticsearch deployment you are sending the logs or metrics to. Since you cannot explicitly allow traffic from certain deployments currently, associating traffic filters with your monitoring deployment will result in deployments being blocked when sending data.

Please note that it’s on our short term plan to support stack monitoring specifically when traffic filters are enabled, so keep your eye out for that!