› ›

How monitoring works

Each Elasticsearch node, Logstash node, Kibana instance, and Beat instance is considered unique in the cluster based on its persistent UUID, which is written to the path.data directory when the node or instance starts.

Monitoring documents are just ordinary JSON documents built by monitoring each Elastic Stack component at a specified collection interval. If you want to alter the templates for these indices, see Configuring data streams/indices for monitoring.

Metricbeat is used to collect monitoring data and to ship it directly to the monitoring cluster.

To learn how to collect monitoring data, see:

Legacy collection methods
Collecting monitoring data with Metricbeat
Monitoring Kibana
Monitoring Logstash
Monitoring Beats:
- Auditbeat
- Filebeat
- Functionbeat
- Heartbeat
- Metricbeat
- Packetbeat
- Winlogbeat

© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/how-monitoring-works.html