X-pack ID monitoring Issue

Elastic Stack Elasticsearch
1

I'm working with amazon EC2 instances, and duplicate some instances by running new instances from AMI.

After installing logstash 6.2 and x-pack on every instance, I'm trying this call curl -XGET 'localhost:9600/?pretty'

and I get

{
  "host" : "NODEJS-SPOT-i-0ab735eb978ce96a1",
  "version" : "6.2.4",
  "http_address" : "127.0.0.1:9600",
  "id" : "d3f9b1e7-6515-4248-8580-bdf3ec30b97d",
  "name" : "NODEJS-SPOT-i-0ab735eb978ce96a1",
  "build_date" : "2018-04-12T22:29:17Z",
  "build_sha" : "a425a422e03087ac34ad6949f7c95ec6d27faf14",
  "build_snapshot" : false
}

where host and name are always different between instances. but the "id", is always the same.

on all my instances.

the issue is that kibana or ELK, differentiate the information based on the uuid.

in the previous version of ELK/kibana there was that

xpack.monitoring.node_resolver
The node resolver controls how nodes are considered unique. 
This can be set to either uuid, transport_address, or name. 
uuid controls uniqueness based on the node’s persistent ID.

but it doesn't seem to be present anymore in ELK 6.2

Any idea how to tell ELK 6.2 to use name instead of ID?

Any idea where logstash is taking the id or the http_address from ? maybe I can change that? and it will solve my problems

thanks

2

Hi @Yoni_Al1984,

I think as you are duplicating instances and the UUID is persistent so I think as the UUID is already generated and instances are clone, these get reflected everywhere in all of your deployed instances. What AMI are you using for deploying instances?

Regards,
Yogesh Gaikwad

3

Hello @Yogesh_Gaikwad ,

Yes it seems to be like that. I’m creating an AMI in the EC2 console and then launch a. Ew instance.

The UUID of the system itself is different

cat /sys/hypervisor/uuid

Will give me different UUID.

Where logstash is taking the uuid from?

Thanks

4

Hello @Yogesh_Gaikwad
Any idea that can help ?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.