To monitor the health of the cluster, the monitoring feature collects metrics from each node and stores them in Elasticsearch Indices. All settings associated with monitoring in Elasticsearch must be set in either the elasticsearch.yml file for each node or, where possible, in the dynamic cluster settings.

In order to start monitoring, we need to check the cluster settings, which can be done in the following way −

GET _cluster/settings
{
   "persistent" : { },
   "transient" : { }
}

Each component in the stack is responsible for monitoring itself and then forwarding those documents to the Elasticsearch production cluster for both routing and indexing (storage). The routing and indexing processes in Elasticsearch are handled by what are called collectors and exporters.

Collectors

Collector runs once per each collection interval to obtain data from the public APIs in Elasticsearch that it chooses to monitor. When the data collection is finished, the data is handed in bulk to the exporters to be sent to the monitoring cluster.

There is only one collector per data type gathered. Each collector can create zero or more monitoring documents.

Exporters

Exporters take data collected from any Elastic Stack source and route it to the monitoring cluster. It is possible to configure more than one exporter, but the general and default setup is to use a single exporter. Exporters are configurable at both the node and cluster level.

There are two types of exporters in Elasticsearch −

• local − This exporter routes data back into the same cluster

• http − The preferred exporter, which you can use to route data into any supported Elasticsearch cluster accessible via HTTP.

Before exporters can route monitoring data, they must set up certain Elasticsearch resources. These resources include templates and ingest pipelines