[role="xpack"]
[[monitoring-internal-collection-legacy]]
=== Collect {ls} monitoring data using legacy collectors
++++
<titleabbrev>Legacy collection (deprecated)</titleabbrev>
++++

deprecated[7.9.0]

==== Components for legacy collection

Monitoring {ls} with legacy collection uses these components:

* <<logstash-monitoring-collectors-legacy,Collectors>>
* <<logstash-monitoring-output-legacy,Output>>

These pieces live outside of the default Logstash pipeline in a dedicated monitoring
pipeline. This configuration ensures that all data and processing has a minimal
impact on ordinary Logstash processing. Existing Logstash features, such as the
<<plugins-outputs-elasticsearch,`elasticsearch` output>>, can be reused to
benefit from its retry policies. 

NOTE: The `elasticsearch` output that is used for monitoring {ls} is 
configured exclusively through settings found in `logstash.yml`. It is not 
configured by using anything from the Logstash configurations that might also be 
using their own separate `elasticsearch` outputs.


The production {es} cluster should be configured to receive {ls} monitoring
data. This configuration enables the production {es} cluster to add metadata
(for example, its cluster UUID) to the Logstash monitoring data and then route
it to the monitoring clusters. For more information  about typical monitoring
architectures, see  {ref}/how-monitoring-works.html[How monitoring works] in the
{ref}[Elasticsearch Reference]. 


include::collectors-legacy.asciidoc[]
include::monitoring-output-legacy.asciidoc[]


[[configure-internal-collectors-legacy]]
==== Configure {ls} monitoring with legacy collectors
++++
<titleabbrev>Configure legacy collection</titleabbrev>
++++

To monitor Logstash nodes:

. Specify where to send monitoring data. This cluster is often referred to as
the _production cluster_. For examples of typical monitoring architectures, see
{ref}/how-monitoring-works.html[How monitoring works].
+
--
IMPORTANT: To visualize Logstash as part of the Elastic Stack (as shown in Step
6), send metrics to your _production_ cluster. Sending metrics to a dedicated
monitoring cluster will show the Logstash metrics under the _monitoring_ cluster.

--

. Verify that the `xpack.monitoring.collection.enabled` setting is `true` on the
production cluster. If that setting is `false`, the collection of monitoring data
is disabled in {es} and data is ignored from all other sources.

. Configure your Logstash nodes to send metrics by setting
`xpack.monitoring.enabled` to `true` and specifying the destination {es} node(s)
as `xpack.monitoring.elasticsearch.hosts` in `logstash.yml`. 
If {security-features} are enabled, you also need to specify the credentials for
the {ref}/built-in-users.html[built-in `logstash_system` user]. 
For more information about these settings, see <<monitoring-settings-legacy>>.
+
--
[source,yaml]
--------------------------------------------------
xpack.monitoring.enabled: true  
xpack.monitoring.elasticsearch.hosts: ["http://es-prod-node-1:9200", "http://es-prod-node-2:9200"] <1>
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "changeme"
--------------------------------------------------

<1> If SSL/TLS is enabled on the production cluster, you must
connect through HTTPS. As of v5.2.1, you can specify multiple
Elasticsearch hosts as an array as well as specifying a single
host as a string. If multiple URLs are specified, Logstash
can round-robin requests to these production nodes. 
--

. If SSL/TLS is enabled on the production {es} cluster, specify the trusted
CA certificates that will be used to verify the identity of the nodes
in the cluster.
+
--
To add a CA certificate to a Logstash node's trusted certificates, you
can specify the location of the PEM encoded certificate with the
`certificate_authority` setting:

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.ssl.certificate_authority: /path/to/ca.crt
--------------------------------------------------

To add a CA without having it loaded on disk, you can specify a hex-encoded
SHA 256 fingerprint of the DER-formatted CA with the `ca_trusted_fingerprint` setting:

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint: 2cfe62e474fb381cc7773c84044c28c9785ac5d1940325f942a3d736508de640
--------------------------------------------------

[NOTE]
====
A self-secured Elasticsearch cluster will provide the fingerprint of its CA to the console during setup.

You can also get the SHA256 fingerprint of an Elasticsearch's CA using the `openssl` command-line utility on the Elasticsearch host:

[source,shell]
--------------------------------------------------
openssl x509 -fingerprint -sha256 -in $ES_HOME/config/certs/http_ca.crt
--------------------------------------------------
====

Alternatively, you can configure trusted certificates using a truststore
(a Java Keystore file that contains the certificates):

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.ssl.truststore.path: /path/to/file
xpack.monitoring.elasticsearch.ssl.truststore.password: password
--------------------------------------------------

Also, optionally, you can set up client certificate using a keystore
(a Java Keystore file that contains the certificate) or using a certificate and key file pair:

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file
xpack.monitoring.elasticsearch.ssl.keystore.password: password
--------------------------------------------------

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.ssl.certificate: /path/to/certificate
xpack.monitoring.elasticsearch.ssl.key: /path/to/key
--------------------------------------------------

Set sniffing to `true` to enable discovery of other nodes of the {es} cluster.
It defaults to `false`.

[source,yaml]
--------------------------------------------------
xpack.monitoring.elasticsearch.sniffing: false
--------------------------------------------------

--

. Restart your Logstash nodes.

. To verify your monitoring configuration, point your web browser at your {kib}
host, and select **Monitoring** from the side navigation. Metrics reported from
your Logstash nodes should be visible in the Logstash section. When security is
enabled, to view the monitoring dashboards you must log in to {kib} as a user
who has the `kibana_user` and `monitoring_user` roles.
+
image::images/monitoring-ui.png["Monitoring",link="images/monitoring-ui.png"]

include::../settings/monitoring-settings-legacy.asciidoc[]

