X-pack monitoring logstash

[Costi (Diaconita Costinel)]

Hi! I am using elastic cloud enterprise and i configured logstash.yml to use xpack monitoring.

After i run logstash.conf to get some data into ES, i cannot see in the Monitoring tab what x-pack has monitored for logstash. I can only see for ES, kibana and APM.
I also run GET /_xpack/security/user/ and GET /_xpack/ and i have x-pack enabled for logstash.

Does anyone have any ideea?

Thanks!

[Alex_Piggott]

Can you share the relevant bit of the logstash config, suitably sanitized?

(There shouldn't be any difference between how you'd do this in cloud and normal Elasticsearch)

[Costi (Diaconita Costinel)]

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: "*****"
xpack.monitoring.elasticsearch.password: "***"
xpack.monitoring.elasticsearch.url: ["https://*****/"]

And also i have configure the cloud.auth and cloud.id, that's all.

Thanks!

[Alex_Piggott]

Can you confirm that curl -u USERNAME:PASS URL works?

What roles did you set the user up with?

Oh one thing ... if it is using cloud.id for monitoring (I haven't played with logstash for ages, so not sure which params that overwrites) then that's the problem because it gives the wrong URL in ECE (it's designed for ESS) as you can see by base64 decoding it .. it uses :443 as the port not :9243 (which is the ECE default). Even if that isn't the problem for monitoring, it's likely to be a problem somewhere

To make applications play nice with cloud.id in ECE you have to use (eg) iptables to map 443 to 9243