Configuring X-Pack in Logstash

You can configure Elasticsearch settings for X-Pack features in the elasticsearch.yml file. If you are using Kibana, there are also settings in the kibana.yml file. See X-Pack Settings.

The following Logstash settings are configured in the logstash.yml and pertain to specific X-Pack features.

Monitoring Settings in Logstash

You can set the following xpack.monitoring settings in logstash.yml to control how monitoring data is collected from your Logstash nodes. However, the defaults work best in most circumstances. For more information about configuring Logstash, see Settings File.

Set to false to disable X-Pack monitoring.
Controls how often data samples are collected and shipped on the Logstash side. Defaults to 10s.
The Elasticsearch instances that you want to ship your Logstash metrics to. This might be the same Elasticsearch instance specified in the outputs section in your Logstash configuration, or a different one. This is not the URL of your dedicated monitoring cluster. Even if you are using a dedicated monitoring cluster, the Logstash metrics must be routed through your production cluster. You can specify a single host as a string, or specify multiple hosts as an array. Defaults to http://localhost:9200.
xpack.monitoring.elasticsearch.username and xpack.monitoring.elasticsearch.password
If your Elasticsearch is protected with basic authentication, these settings provide the username and password that the Logstash instance uses to authenticate for shipping monitoring data.
Optional setting that enables you to specify a path to the .pem file for the certificate authority for your Elasticsearch instance.
Optional settings that provide the paths to the Java keystore (JKS) to validate the server’s certificate.
Optional settings that provide the password to the truststore.
Optional settings that provide the paths to the Java keystore (JKS) to validate the client’s certificate.
Optional settings that provide the password to the keystore.