[float]
[role="xpack"]
[[logstash-monitoring-output]]
==== Output

Like all Logstash pipelines, the purpose of the dedicated monitoring pipeline is 
to send events to outputs. In the case of Logstash monitoring, the output 
is always an `elasticsearch` output. However, unlike ordinary Logstash pipelines, 
the output is configured within the `logstash.yml` settings file via the
`monitoring.elasticsearch.*` settings.

Other than its unique manner of configuration, this `elasticsearch` output
behaves like all `elasticsearch` outputs, including its ability to pause data 
collection when issues exist with the output.

IMPORTANT: It is critical that all Logstash nodes share the same setup. 
Otherwise, monitoring data might be routed in different ways or to different places.

[float]
[[logstash-monitoring-default]]
===== Default Configuration

If a Logstash node does not explicitly define a monitoring output setting, 
the following default configuration is used:

[source,yaml]
---------------------------------------------------
monitoring.elasticsearch.hosts: [ "http://localhost:9200" ]
---------------------------------------------------

//TODO:  Verify the following sentence:

All data produced by Logstash monitoring is indexed in the monitoring 
cluster by using the `.monitoring-logstash` template, which is managed by the
{ref}/es-monitoring-exporters.html[exporters] within {es}. 

If you are working with a cluster that has {security-features} enabled, extra
steps are necessary to properly configure Logstash. For more information, see 
<<configuring-logstash>>. 


//TODO:  Verify the following sentence:

IMPORTANT: When discussing security relative to the `elasticsearch` output,
remember that all users are managed on the production cluster, which is
identified in the `monitoring.elasticsearch.hosts` setting. This is particularly
important when you move from development environments to production
environments, where you often have dedicated monitoring clusters.

For more information about the configuration options for the output, see 
<<monitoring-settings>>.