[Metricbeat] Logstash modules with xpack.enabled: true will not be able to set their customer data stream.

[Camille Li]

• Version: 8.10 to 8.13
• Operating System: linux / official docker image
• Steps to Reproduce:

Metricbeat.yaml:

metricbeat.modules:
- module: logstash
  period: 60s
  hosts: ["192.168.50.46:9600"]
  xpack.enabled: true

- module: system
  enabled: false

logging.level: debug
setup.template.name: ".monitoring-test-logstash-8-mb"
setup.template.pattern: ".monitoring-test-logstash-8-mb*"
# setup.template.enabled: true
setup.ilm.enabled: false

output.elasticsearch:
  hosts: ['xxxx']
  username: elastic
  password: xxx
  index: ".monitoring-test-logstash-8-mb"

Given the specified configurationxpack.enabled: true, if metricbeat.config.modules.path: is not configured, ingestion will default to the .monitoring-logstash-8-mb index, despite the ability to set up custom index templates and data streams.

I tried to find some logs related to it. Even with debug mode, I have no luck finding logs related.

It only complain when I try to run metricbeat modules disable logstash
Error in modules manager: modules management requires 'metricbeat.config.modules.path' setting

[Camille Li]

Close as this seems to be expected when xpack is enable and data need to go to default data stream for monitoring UI.