anchor.diff:  If {es} {security-features} are enabled, you must have `monitor` cluster
   privileges to  view the cluster settings and `manage` cluster privileges
   to change them.
  -
  -// end::disable-default-collection[]
   --
   
   . {kibana-ref}/monitoring-data.html[View the monitoring data in {kib}]. 
  
positive.code: 
  image::monitoring/images/metricbeat.png[Example monitoring architecture]
  
  //NOTE: The tagged regions are re-used in the Stack Overview.
  
  . Enable the collection of monitoring data. +
  +
  --
  // tag::enable-collection[]
  
negative.code: metricbeat modules enable elasticsearch-xpack
  ----------------------------------------------------------------------
  
  Alternatively, you can use the {es} module, as described in the
  {metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module usage for {stack} monitoring]. 
  --
  
  . Configure the {es} {xpack} module in {metricbeat} on each {es} node.
  +
  --
  The `modules.d/elasticsearch-xpack.yml` file contains the following settings:
  
  [source,yaml]
  ----------------------------------
    - module: elasticsearch
      xpack.enabled: true
      period: 10s
      hosts: ["http://localhost:9200"] <1>
      #scope: node <2>
      #username: "user"
      #password: "secret"
  ----------------------------------
  <1> By default, the module collects {es} monitoring metrics from
  `http://localhost:9200`. If that host and port number are not correct, you must
  update the `hosts` setting. If you configured {es} to use encrypted
  communications, you must access it via HTTPS. For example, use a `hosts` setting
  like `https://localhost:9200`.
  <2> By default, `scope` is set to `node` and each entry in the `hosts` list
  indicates a distinct node in an {es} cluster. If you set `scope` to `cluster`,
  each entry in the `hosts` list indicates a single endpoint for a distinct {es}
  cluster (for example, a load-balancing proxy fronting the cluster).
  
  If Elastic {security-features} are enabled, you must also provide a user ID
  and password so that {metricbeat} can collect metrics successfully: 
  
  