Configuring the Elasticsearch monitor profile

To configure the KM, set the following preferences on the Add Monitoring Configuration dialog. 

The following monitor types that are part of Elasticsearch Monitor are also loaded when you configure the KM.

  • Cluster
  • Elasticsearch
  • Elasticsearch System
  • Index
  • Indices
  • JVM
  • Node
  • Shards

Monitoring SolutionVersionMonitor ProfileMonitor Type
Elasticsearch1.0.10Elasticsearch MonitorElasticsearch

Click  to add the Elasticsearch host details.


Enter a display name for the monitored cluster. A container is created with the display name.

Host Name

Enter the hostname or IP address of any node within the Elasticsearch cluster.

For IPv6 address, use the following format:

[<IPv6 address>]

If the host is present in the AWS environment, you need to add -DES_ENV=AWS in the JVM Arguments field.

Note: Square brackets are mandatory for IPv6 address.

Port NumberEnter the port number of the Elasticsearch service. Default port number is 9200.
Connection Protocol

Select the connection protocol.

  • http
  • https
Advanced Configuration
Read Timeout (seconds)

Enter the timeout period for the HTTP connection. If no data is available at the end of this interval, the collector returns an error and proceeds to the next scheduled poll. Default value is 50 seconds.

Maximum Thread Pool Size

This value indicates the maximum number of threads the performance collector can spawn for data collection. For large number of indices (more than 1000), this value must be greater than 50.

Default value is 50 threads.

Failover Retry Attempts

Enter the failover retry attempts. This value indicates the number of retries after which collector will activate failover. If a connection node in Elasticsearch cluster is down (service is not running) the collector will try to select other nodes from cluster after these attempts are exhausted. Collector prefers client nodes for connection when failover is initiated.

Default value is three retry attempts.

Instance format

Select the following options for instances.      

  • Label: Creates the instance ID from the name entered in the Label field.
  • Cluster ID: Creates the instance ID using cluster ID
  • Cluster Name: Creates the instance ID using the cluster name.


  • If you change this option after upgrade (or after instances are discovered), then it creates new instances with the selected instance ID format.
  • Setting the Instance format options overrides the Node instance format options. 
Node instance format

Select the following values to include in the PATROL event details description. This also changes the node instance ID.

  • ID: Node ID 
  • Name: Node name 
  • Cluster name: Name of the cluster 


  • If you change this option after upgrade (or after instances are discovered), then it creates new node instances with the selected instance ID format.
  • If Cluster name is selected then the instance id will be formed as Clustername@nodeId or Clustername@nodeName.
JVM Arguments

Type the additional Java Virtual Machine arguments for the Java collector. For example, for Java memory settings: -Xms256m -Xmx1024m.

Note: If you have AWS-hosted Elasticsearch, enter -DES_ENV=AWS in the field.

Authentication Details
UsernameEnter the username.
PasswordEnter the password.


Client Certificate File Path (.pfx)

Enter the path (along with the filename and .pfx extension) where the certificate file is located.


The client certificate file must reside on the host where the PATROL Agent is running. BMC PATROL default account must have read permission on the directory where the client certificate file is located.

The path should be an absolute path to the location where the certificate resides on the PATROL Agent. For example, /home/patrol/membernode.pfx

Client Certificate PasswordEnter a password for the certificate file.
Index Filter
Include Index

Enter the Elasticsearch index name that you want to include for monitoring. Enter a regular expression to include multiple indices. Separate regular expressions by using pipe (|). By default, all indices are included for monitoring.

Exclude IndexEnter the Elasticsearch index name that you want to exclude from monitoring. Enter a regular expression to exclude multiple indices. Separate regular expressions by using pipe (|).
Manage Debug
Enable PSL Debug

Select the check box to enable the PSL debug. 

The debug file is located at $PATROL_HOME/log/trace/<hostname>/<port>/issow.log

Java Collector Debug

Select the check box to enable the Java collector debug.

  • WARNING - Failures that can affect monitoring
  • INFO - Failures and exceptions in the collection
  • ALL - WARNING, INFO and JSON responses of all REST queries

The debug file is located at $PATROL_HOME/esk/log directory. The file name format is <EnvName>_ESKCollector.log.*

Enter the JAVA home details before you save the configuration.



By default, PATROL for Elasticsearch uses JAVA Runtime Environment (JRE) that is installed with the PATROL Agent. To use your own JRE that is installed in a different location, specify the path for the JAVA home directory.

For example, if your JAVA executable exists in the /usr/java/jdk1.8.0_45/jre/bin/java path, specify /usr/java/jdk1.8.0_45/jre as the value in this field.

Note: If you have specified a different path in this field, restart the PATROL Agent to apply the changes.

Enable device mapping

Clear the check box to disable device mapping. Enabling device mapping consolidates Elasticsearch monitoring at device level.

Was this page helpful? Yes No Submitting... Thank you


  1. Magen Kamil

    what are the permissions required for the user?

    Nov 21, 2022 03:04
    1. Krutarth Mohakud

      Magen Kamil - Please see the following page and let me know if it is helpful.

      Prerequisites - BMC PATROL for Elasticsearch 1.0.10 - BMC Documentation

      Nov 21, 2022 05:53