[role="xpack"]
[[monitoring-settings-legacy]]
==== Monitoring settings for legacy collection
++++
<titleabbrev>Monitoring Settings</titleabbrev>
++++

You can set the following `xpack.monitoring` settings in `logstash.yml` to
control how monitoring data is collected from your Logstash nodes. However, the
defaults work best in most circumstances. For more information about configuring
Logstash, see <<logstash-settings-file>>.


[[monitoring-general-settings-legacy]]
===== General monitoring settings

`xpack.monitoring.enabled`::

Monitoring is disabled by default. Set to `true` to enable {xpack} monitoring.

`xpack.monitoring.elasticsearch.hosts`::

The {es} instances that you want to ship your Logstash metrics to. This might be
the same {es} instance specified in the `outputs` section in your Logstash
configuration, or a different one. This is *not* the URL of your dedicated
monitoring cluster. Even if you are using a dedicated monitoring cluster, the
Logstash metrics must be routed through your production cluster. You can specify
a single host as a string, or specify multiple hosts as an array. Defaults to
`http://localhost:9200`.

NOTE: If your Elasticsearch cluster is configured with dedicated master-eligible
nodes, Logstash metrics should _not_ be routed to these nodes, as doing so can
create resource contention and impact the stability of the Elasticsearch
cluster. Therefore, do not include such nodes in
`xpack.monitoring.elasticsearch.hosts`.

`xpack.monitoring.elasticsearch.proxy`::

The monitoring {es} instance and monitored Logstash can be separated by a proxy.
To enable Logstash to connect to a proxied {es}, set this value to the URI of the intermediate
proxy using the standard URI format, `<protocol>://<host>` for example `http://192.168.1.1`.
An empty string is treated as if proxy was not set.

`xpack.monitoring.elasticsearch.username` and `xpack.monitoring.elasticsearch.password`::

If your {es} is protected with basic authentication, these settings provide the
username and password that the Logstash instance uses to authenticate for
shipping monitoring data.


[[monitoring-collection-settings-legacy]]
===== Monitoring collection settings

`xpack.monitoring.collection.interval`::

Controls how often data samples are collected and shipped on the Logstash side.
Defaults to `10s`. If you modify the collection interval, set the 
`xpack.monitoring.min_interval_seconds` option in `kibana.yml` to the same value.


[[monitoring-ssl-settings-legacy]]
===== Monitoring TLS/SSL settings

You can configure the following Transport Layer Security (TLS) or
Secure Sockets Layer (SSL) settings. For more information, see 
<<ls-monitoring-user>>.

`xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint`::

Optional setting that enables you to specify the hex-encoded SHA-256 fingerprint of the
certificate authority for your {es} instance.
[NOTE]
=====
A self-secured Elasticsearch cluster will provide the fingerprint of its CA to the console during setup.

You can also get the SHA256 fingerprint of an Elasticsearch's CA using the `openssl` command-line utility on the Elasticsearch host:

[source,shell]
--------------------------------------------------
openssl x509 -fingerprint -sha256 -in $ES_HOME/config/certs/http_ca.crt
--------------------------------------------------
=====

`xpack.monitoring.elasticsearch.ssl.certificate_authority`::

Optional setting that enables you to specify a path to the `.pem` file for the
certificate authority for your {es} instance.

`xpack.monitoring.elasticsearch.ssl.truststore.path`::

Optional settings that provide the paths to the Java keystore (JKS) to validate
the server’s certificate.

`xpack.monitoring.elasticsearch.ssl.truststore.password`::

Optional settings that provide the password to the truststore.

`xpack.monitoring.elasticsearch.ssl.keystore.path`::

Optional settings that provide the paths to the Java keystore (JKS) to validate
the client’s certificate.

`xpack.monitoring.elasticsearch.ssl.keystore.password`::

Optional settings that provide the password to the keystore.

`xpack.monitoring.elasticsearch.ssl.certificate`::

Optional setting that provides the path to an SSL certificate to use to authenticate the client.
This certificate should be an OpenSSL-style X.509 certificate file.

NOTE: This setting can be used only if `xpack.monitoring.elasticsearch.ssl.key` is set.

`xpack.monitoring.elasticsearch.ssl.key`::

Optional setting that provides the path to an OpenSSL-style RSA private key that corresponds to the `xpack.monitoring.elasticsearch.ssl.certificate`.

NOTE: This setting can be used only if `xpack.monitoring.elasticsearch.ssl.certificate` is set.

`xpack.monitoring.elasticsearch.ssl.verification_mode`::

Option to validate the server’s certificate. Defaults to `full`. To
disable, set to `none`. Disabling this severely compromises security.

`xpack.monitoring.elasticsearch.ssl.cipher_suites`::

Optional setting that provides the list of cipher suites to use, listed by priorities.
Supported cipher suites vary depending on the Java and protocol versions.

[[monitoring-additional-settings-legacy]]
===== Additional settings

`xpack.monitoring.elasticsearch.cloud_id`::

If you're using {es} in {ecloud}, you should specify the identifier here.
This setting is an alternative to `xpack.monitoring.elasticsearch.hosts`.
If `cloud_id` is configured, `xpack.monitoring.elasticsearch.hosts` should not be used.
The {es} instances that you want to ship your Logstash metrics to. This might be
the same {es} instance specified in the `outputs` section in your Logstash
configuration, or a different one.

`xpack.monitoring.elasticsearch.cloud_auth`::

If you're using {es} in {ecloud}, you can set your auth credentials here.
This setting is an alternative to both `xpack.monitoring.elasticsearch.username`
and `xpack.monitoring.elasticsearch.password`. If `cloud_auth` is configured,
those settings should not be used.

`xpack.monitoring.elasticsearch.api_key`::

Authenticate using an Elasticsearch API key. Note that this option also requires using SSL.

The API key Format is `id:api_key` where `id` and `api_key` are as returned by the Elasticsearch
https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key API].
