[float] [role="xpack"] [[logstash-monitoring-output]] ==== Output Like all Logstash pipelines, the purpose of the dedicated monitoring pipeline is to send events to outputs. In the case of Logstash monitoring, the output is always an `elasticsearch` output. However, unlike ordinary Logstash pipelines, the output is configured within the `logstash.yml` settings file via the `monitoring.elasticsearch.*` settings. Other than its unique manner of configuration, this `elasticsearch` output behaves like all `elasticsearch` outputs, including its ability to pause data collection when issues exist with the output. IMPORTANT: It is critical that all Logstash nodes share the same setup. Otherwise, monitoring data might be routed in different ways or to different places. [float] [[logstash-monitoring-default]] ===== Default Configuration If a Logstash node does not explicitly define a monitoring output setting, the following default configuration is used: [source,yaml] --------------------------------------------------- monitoring.elasticsearch.hosts: [ "http://localhost:9200" ] --------------------------------------------------- //TODO: Verify the following sentence: All data produced by Logstash monitoring is indexed in the monitoring cluster by using the `.monitoring-logstash` template, which is managed by the {ref}/es-monitoring-exporters.html[exporters] within {es}. If you are working with a cluster that has {security-features} enabled, extra steps are necessary to properly configure Logstash. For more information, see <>. //TODO: Verify the following sentence: IMPORTANT: When discussing security relative to the `elasticsearch` output, remember that all users are managed on the production cluster, which is identified in the `monitoring.elasticsearch.hosts` setting. This is particularly important when you move from development environments to production environments, where you often have dedicated monitoring clusters. For more information about the configuration options for the output, see <>.