Monitoring settings in Kibana

By default, Stack Monitoring is enabled, but data collection is disabled. When you first start Kibana monitoring, you are prompted to enable data collection. If you are using Elastic Stack security features, you must be signed in as a user with the cluster:manage privilege to enable data collection. The built-in superuser role has this privilege and the built-in elastic user has this role.

You can adjust how monitoring data is collected from Kibana and displayed in Kibana by configuring settings in the kibana.yml file. There are also monitoring.ui.elasticsearch.* settings, which support the same values as Kibana configuration settings.

To control how data is collected from your Elasticsearch nodes, you configure xpack.monitoring.collection settings in elasticsearch.yml. To control how monitoring data is collected from Logstash, configure monitoring settings in logstash.yml.

For more information, check out Monitor a cluster.

General monitoring settings

monitoring.cluster_alerts.email_notifications.enabled The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 7.11 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Supported on: Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Deprecated This functionality is deprecated. You can still use it, but it'll be removed in a future Self-managed Elastic deployments update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

When enabled, sends email notifications for Watcher alerts to the specified email address.

Datatype: bool

Default: true

Deprecation details

Deprecated in 7.11.

monitoring.cluster_alerts.email_notifications.email_address The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 7.11 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Supported on: Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability Deprecated This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Cloud Hosted update. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Deprecated This functionality is deprecated. You can still use it, but it'll be removed in a future Self-managed Elastic deployments update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

When enabled, specifies the email address where you want to receive cluster alert notifications.

Datatype: string

Deprecation details

Deprecated in 7.11.

monitoring.ui.ccs.enabled

Supported on: Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Set to true (default) to enable cross-cluster search of your monitoring data. The remote_cluster_client role must exist on each node.

Datatype: bool

Default: true

monitoring.ui.elasticsearch.hosts

Specifies the location of the Elasticsearch cluster where your monitoring data is stored.

By default, this is the same as elasticsearch.hosts. This setting enables you to use a single Kibana instance to search and visualize data in your production cluster as well as monitor data sent to a dedicated monitoring cluster.

Datatype: string

monitoring.ui.elasticsearch.username

Specifies the username used by Kibana monitoring to establish a persistent connection in Kibana to the Elasticsearch monitoring cluster and to verify licensing status on the Elasticsearch monitoring cluster when using monitoring.ui.elasticsearch.hosts.

All other requests performed by Stack Monitoring to the monitoring Elasticsearch cluster uses the authenticated user's credentials, which must be the same on both the Elasticsearch monitoring cluster and the Elasticsearch production cluster.

If not set, Kibana uses the value of the elasticsearch.username setting.

Datatype: string

monitoring.ui.elasticsearch.password

Specifies the password used by Kibana monitoring to establish a persistent connection in Kibana to the Elasticsearch monitoring cluster and to verify licensing status on the Elasticsearch monitoring cluster when using monitoring.ui.elasticsearch.hosts.

All other requests performed by Stack Monitoring to the monitoring Elasticsearch cluster use the authenticated user's credentials, which must be the same on both the Elasticsearch monitoring cluster and the Elasticsearch production cluster.

If not set, Kibana uses the value of the elasticsearch.password setting.

Datatype: string

monitoring.ui.elasticsearch.serviceAccountToken

Specifies a service account token for the Elasticsearch cluster where your monitoring data is stored when using monitoring.ui.elasticsearch.hosts. This setting is an alternative to using monitoring.ui.elasticsearch.username and monitoring.ui.elasticsearch.password.

Datatype: string

monitoring.ui.elasticsearch.pingTimeout

Specifies the time in milliseconds to wait for Elasticsearch to respond to internal health checks. By default, it matches the elasticsearch.pingTimeout setting, which has a default value of 30000.

Datatype: int

Default: 30000

monitoring.ui.elasticsearch.ssl

Shares the same configuration as elasticsearch.ssl. These settings configure encrypted communication between Kibana and the monitoring cluster.

Datatype: string

Monitoring collection settings

These settings control how data is collected from Kibana.

monitoring.kibana.collection.enabled

Set to true (default) to enable data collection from the Kibana NodeJS server for Kibana dashboards to be featured in Stack Monitoring.

Datatype: bool

Default: true

monitoring.kibana.collection.interval

Supported on: Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Specifies the number of milliseconds to wait in between data sampling on the Kibana NodeJS server for the metrics that are displayed in the Kibana dashboards. Defaults to 10000 (10 seconds).

Datatype: int

Default: 10000

Monitoring UI settings

These settings adjust how Stack Monitoring displays monitoring data. However, the defaults work best in most circumstances. For more information about configuring Kibana, see Setting Kibana server properties.

monitoring.ui.elasticsearch.logFetchCount

Specifies the number of log entries to display in Stack Monitoring. Defaults to 10. The maximum value is 50.

Datatype: int

Default: 10

monitoring.ui.enabled

Set to false to hide Stack Monitoring. The monitoring back-end continues to run as an agent for sending Kibana stats to the monitoring cluster. Defaults to true.

Datatype: bool

Default: true

monitoring.ui.logs.index

Specifies the name of the indices that are shown on the Logs page in Stack Monitoring. The default value is filebeat-*.

Datatype: string

Default: filebeat-*

monitoring.ui.metricbeat.index The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 8.15 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Used as a workaround to avoid querying metricbeat-* indices which are now no longer queried.

Datatype: string

Default: metricbeat-*

Deprecation details

This setting was deprecated in 8.15.0.

monitoring.ui.max_bucket_size

Specifies the number of term buckets to return out of the overall terms list when performing terms aggregations to retrieve index and node metrics. For more information about the size parameter, see Terms Aggregation. Defaults to 10000.

Datatype: int

Default: 10000

monitoring.ui.min_interval_seconds

Specifies the minimum number of seconds that a time bucket in a chart can represent. Defaults to 10. If you modify the monitoring.ui.collection.interval in elasticsearch.yml, use the same value in this setting.

Datatype: int

Default: 10

monitoring.ui.kibana.reporting.stale_status_threshold_seconds

Specifies how many seconds can pass before the Kibana status reports are considered stale. Defaults to 120.

Datatype: int

Default: 120

Monitoring UI container settings

Stack Monitoring exposes the Cgroup statistics that we collect for you to make better decisions about your container performance, rather than guessing based on the overall machine performance. If you are not running your applications in a container, then Cgroup statistics are not useful.

monitoring.ui.container.elasticsearch.enabled

For Elasticsearch clusters that are running in containers, this setting changes the Node Listing to display the CPU utilization based on the reported Cgroup statistics. It also adds the calculated Cgroup CPU utilization to the Node Overview page instead of the overall operating system's CPU utilization. Defaults to false.

Datatype: bool

Default: false

monitoring.ui.container.logstash.enabled

For Logstash nodes that are running in containers, this setting changes the Logstash Node Listing to display the CPU utilization based on the reported Cgroup statistics. It also adds the calculated Cgroup CPU utilization to the Logstash node detail pages instead of the overall operating system's CPU utilization. Defaults to false.

Datatype: bool

Default: false