How monitoring works

Each Elasticsearch node, Logstash node, Kibana instance, and Beat is considered unique in the cluster based on its persistent UUID, which is written to the path.data directory when the node or instance starts.

Monitoring documents are just ordinary JSON documents built by monitoring each Elastic Stack component at some collection interval. If you want to alter the templates for these indices, see Configuring indices for monitoring.

Each component in the stack is responsible for monitoring itself and then forwarding those documents to the Elasticsearch production cluster for both routing and indexing (storage). The routing and indexing processes in Elasticsearch are handled by what are called collectors and exporters.

Alternatively, in 6.4 and later, you can use Metricbeat to collect monitoring data about Kibana and ship it directly to the monitoring cluster, rather than routing it through the production cluster. In 6.5 and later, you can also use Metricbeat to collect and ship data about Elasticsearch.

To learn how to collect monitoring data, see: