metricbeat/module/elasticsearch/_meta/docs.md
:::::{admonition} Prefer to use {{agent}} for this use case? Refer to the Elastic Integrations documentation.
::::{dropdown} Learn more {{agent}} is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query data from operating systems, forward data from remote services or hardware, and more. Refer to the documentation for a detailed comparison of {{beats}} and {{agent}}.
::::
:::::
The elasticsearch module collects metrics about {{es}}.
The elasticsearch module works with {{es}} 6.7.0 and later.
The elasticsearch module can be used to collect metrics shown in our {{stack-monitor-app}} UI in {{kib}}. To enable this usage, set xpack.enabled: true and remove any metricsets from the module’s configuration. Alternatively, run metricbeat modules disable elasticsearch and metricbeat modules enable elasticsearch-xpack.
When xpack mode is enabled, all the legacy metricsets are automatically enabled by default. This means that you do not need to manually enable them, and there will be no conflicts or issues because Metricbeat merges the user-defined metricsets with the ones that xpack mode forces to enable. As a result, you can seamlessly collect comprehensive metrics without worrying about dataset overlap or duplication.
metricbeat.modules:
- module: elasticsearch
xpack.enabled: true
metricsets:
- ingest_pipeline
period: 10s
::::{note} When this module is used for {{stack}} Monitoring, it sends metrics to the monitoring index instead of the default index typically used by {{metricbeat}}. For more details about the monitoring index, see Configuring indices for monitoring. ::::
Like other Metricbeat modules, the elasticsearch module accepts a hosts configuration setting. This setting can contain a list of entries. The related scope setting determines how each entry in the hosts list is interpreted by the module.
scope is set to node (default), each entry in the hosts list indicates a distinct node in an {{es}} cluster.scope is set to cluster, each entry in the hosts list indicates a single endpoint for a distinct {{es}} cluster (for example, a load-balancing proxy fronting the cluster).Also like some other modules, the elasticsearch module accepts either a username/password pair of settings or a single api_key setting. You cannot specify the username/password settings and api_key at the same time.
When used, the api_key configuration can be specified as:
stack: ga 9.1.4 The unencoded id:api_key format (api_key: "foo:bar") or the Base64-encoded id:api_key format (api_key: "Zm9vOmJhcgo=").id:api_key format (api_key: "foo:bar").