# X-pack monitoring logstash

**URL:** <https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127>\
**Category:** Elastic Cloud Enterprise (ECE)\
**Created:** [March 6, 2019, 2:04pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127 "2019-03-06T14:04:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Costi](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@Costi](https://discuss.elastic.co/u/Costi)\
**Post date:** [March 6, 2019, 2:04pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127/1 "2019-03-06T14:04:19Z")

</div>

Hi! I am using elastic cloud enterprise and i configured logstash.yml to use xpack monitoring.

After i run logstash.conf to get some data into ES, i cannot see in the Monitoring tab what x-pack has monitored for logstash. I can only see for ES, kibana and APM.  
I also run GET /\_xpack/security/user/ and GET /\_xpack/ and i have x-pack enabled for logstash.

Does anyone have any ideea?

Thanks!

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [March 6, 2019, 2:44pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127/2 "2019-03-06T14:44:37Z")

</div>

Can you share the relevant bit of the logstash config, suitably sanitized?

(There _shouldn't_ be any difference between how you'd do this in cloud and normal Elasticsearch)

---

<div class="post-metadata">

**Author:** ![Costi](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@Costi](https://discuss.elastic.co/u/Costi)\
**Post date:** [March 6, 2019, 2:52pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127/3 "2019-03-06T14:52:12Z")

</div>

```
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: " *****"
xpack.monitoring.elasticsearch.password: "***"
xpack.monitoring.elasticsearch.url: ["https:// ***** /"]

```

And also i have configure the cloud.auth and cloud.id, that's all.

Thanks!

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [March 6, 2019, 3:01pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127/4 "2019-03-06T15:01:41Z")

</div>

Can you confirm that `curl -u USERNAME:PASS URL` works?

What roles did you set the user up with?

Oh one thing ... if it is using `cloud.id` for monitoring (I haven't played with logstash for ages, so not sure which params that overwrites) then that's the problem because it gives the wrong URL in ECE (it's designed for ESS) as you can see by base64 decoding it .. it uses `:443` as the port not `:9243` (which is the ECE default). Even if that isn't the problem for monitoring, it's likely to be a problem _somewhere_ 🙂

To make applications play nice with `cloud.id` in ECE you have to use (eg) `iptables` to map `443` to `9243`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2019, 3:05pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-logstash/171127/5 "2019-03-20T15:05:09Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.