[DOCS] Added sections and Kibana steps

Author: lcawl

docs/en/stack/monitoring/esms.asciidoc

@@ -2,21 +2,28 @@
 [[esms]]
 == {stack} Monitoring Service
 
-The {stack} Monitoring Service (ESMS) is an additional service that deploys
-a monitoring cluster running {es} and {kib}. 
+The {stack} Monitoring Service (ESMS) is a monitoring cluster on Cloud that
+Elastic provides to self-managed commercial customers. If you send your
+monitoring data to the ESMS, it can also be used by Elastic support to provide
+better and faster incident resolution. 
 
-In 6.4 and later, you can use {metricbeat} to ship monitoring data about 
-{kib} to ESMS. In 6.5 and later, you can do the same for {es}.
+NOTE: You must obtain your ESMS cluster URLs and credentials from the Elastic
+support team.
 
-To store monitoring data in ESMS:
+[discrete]
+[[esms-elasticsearch]]
+=== Collecting monitoring data about {es}
 
-. Obtain your ESMS cluster URLs and credentials from the Elastic support team.
+There are two methods for collecting and sending data about the health of your
+production cluster to ESMS: {metricbeat} or collectors and exporters.
 
-. Configure your production cluster to collect data and send it to the 
-monitoring cluster.
-** {ref}/configuring-metricbeat.html[Use {metricbeat}]. This option 
-is available in 6.5 and later versions.
-... Configure the following settings on each node in the production cluster:
+TIP: If you want to monitor {ls}, you must use collectors and exporters to
+route data from the production cluster to ESMS. Otherwise, it is simplest to use
+{metricbeat}. 
+
+To use {metricbeat}:
+
+. Configure the following settings on each node in the production cluster:
 +
 --
 [source,js]
@@ -35,8 +42,10 @@ PUT _cluster/settings
 Alternatively, you can put those settings in the `elasticsearch.yml` file on
 each node. This method, however, requires you to restart each node.
 --
-... {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}].
-... Enable the {es} module in {metricbeat}.
+
+. {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}].
+
+. Enable the {es} module in {metricbeat}.
 +
 --
 For example, to enable the default configuration in the `modules.d` directory, 
@@ -51,12 +60,14 @@ For more information, see
 {metricbeat-ref}/configuration-metricbeat.html[Specify which modules to run] and 
 {metricbeat-ref}/metricbeat-module-elasticsearch.html[{es} module]. 
 --
-... By default, the module collects {es} monitoring metrics from `http://localhost:9200`.
+
+. By default, the module collects {es} monitoring metrics from `http://localhost:9200`.
 If your local {es} node has a different address, you must specify it via the
 `hosts` setting in the `modules.d/elasticsearch-xpack.yml` file. If your cluster
 uses {ref}/configuring-tls.html[encrypted communications], you must access it
 via HTTPS. For example, use a `hosts` setting like `https://localhost:9200`.
-... If {es} {security-features} are enabled in your production cluster,
+
+. If {es} {security-features} are enabled in your production cluster,
 {metricbeat} must use a valid user ID and password to collect metrics
 successfully. 
 +
@@ -67,7 +78,8 @@ Alternatively, use the
 {stack-ov}/built-in-users.html[`remote_monitoring_user` built-in user].
 
 Add the `username` and `password` settings to the {es} module configuration
-file. For example, add the following settings in the `modules.d/elasticsearch-xpack.yml` file:
+file. For example, add the following settings in the
+`modules.d/elasticsearch-xpack.yml` file:
 
 [source,yaml]
 ----------------------------------
@@ -77,7 +89,8 @@ file. For example, add the following settings in the `modules.d/elasticsearch-xp
   password: YOUR_PASSWORD
 ----------------------------------
 --
-... Identify where to send the {es} monitoring data and supply the necessary
+
+. Identify where to send the {es} monitoring data and supply the necessary
 security information. Add the following settings in the {metricbeat}
 configuration file (`metricbeat.yml`):
 +
@@ -93,13 +106,19 @@ output.elasticsearch:
 <2> Replace `MONITORING_AGENT_PASSWORD` with the value provided to you by the
 Elastic support team.
 --
-... {ref}/starting-elasticsearch.html[Start {es}].
-... {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}].
-** {ref}/configuring-monitoring.html[Use HTTP exporters]. For example:
-... Copy the certificates that you obtained from the Elastic support team to the
+
+. {ref}/starting-elasticsearch.html[Start {es}].
+
+. {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}].
+
+To use collectors and exporters:
+
+. Copy the certificates that you obtained from the Elastic support team to the
 {es} configuration directory (`ES_PATH_CONF`) on each node. These certificates
-enable your production cluster to verify the identity of the ESMS and communicate securely.
-... Configure the following settings on each node in the production cluster:
+enable your production cluster to verify the identity of the ESMS and
+communicate securely.
+
+. Configure the following settings on each node in the production cluster:
 +
 --
 [source,js]
@@ -120,13 +139,143 @@ PUT _cluster/settings
 ----------------------------------
 // CONSOLE
 <1> Replace `MONITORING_ELASTICSEARCH_URL` with the appropriate URL from the ESMS.
-<2> Replace `MONITORING_AGENT_PASSWORD` with the value provided to you by the Elastic support team.
+<2> Replace `MONITORING_AGENT_PASSWORD` with the value provided to you by the
+Elastic support team.
 <3> Replace the path and file name with the appropriate information for the file
 provided by the Elastic support team.
 
 Alternatively, you can put those settings in the `elasticsearch.yml` file on
 each node. This method, however, requires you to restart each node.
 --
+
+[discrete]
+[[esms-kibana]]
+=== Collecting monitoring data about {kib}
+
+There are two methods for sending monitoring data about {kib} to ESMS. You can
+send it directly to ESMS by using {metricbeat} or you can route it through
+exporters on the production cluster.
+
+TIP: It is simplest to use {metricbeat}. 
+
+To use {metricbeat}:
+
+. Disable the default collection of {kib} monitoring metrics. +
++
+--
+Add the following setting in the {kib} configuration file (`kibana.yml`): 
+
+[source,yaml]
+----------------------------------
+xpack.monitoring.kibana.collection.enabled: false
+----------------------------------
+
+Leave the `xpack.monitoring.enabled` set to its default value (`true`). 
+
+For more information, see 
+{kibana-ref}/monitoring-settings-kb.html[Monitoring settings in {kib}].
+--
+
+. {kibana-ref}/start-stop.html[Start {kib}].
+
+. Ensure that the `xpack.monitoring.collection.enabled` setting to `true` on 
+each node in the production cluster.
+
+. {metricbeat-ref}/metricbeat-installation.html[Install {metricbeat}] on the 
+same server as {kib}.
+
+. Enable the {kib} module in {metricbeat}. +
++
+--
+For example, to enable the default configuration in the `modules.d` directory, 
+run the following command:
+
+["source","sh",subs="attributes,callouts"]
+----------------------------------------------------------------------
+metricbeat modules enable kibana
+----------------------------------------------------------------------
+
+For more information, see 
+{metricbeat-ref}/configuration-metricbeat.html[Specify which modules to run] and 
+{metricbeat-ref}/metricbeat-module-kibana.html[{kib} module]. 
+--
+
+. Configure the {kib} module in {metricbeat}. +
++
+--
+You must specify the following settings in the `modules.d/kibana.yml` file:
+
+[source,yaml]
+----------------------------------
+- module: kibana
+  metricsets:
+    - stats
+  period: 10s
+  hosts: ["http://localhost:5601"] <1>
+  xpack.enabled: true <2>
+----------------------------------
+<1> This setting identifies the host and port number that are used to access {kib}. 
+<2> This setting ensures that {kib} can read the monitoring data successfully. 
+That is to say, it's stored in the same location and format as monitoring data 
+that is sent by {ref}/es-monitoring-exporters.html[exporters].  
+--
+
+. If the {stack} {security-features} are enabled, you must also provide a user 
+ID and password so that {metricbeat} can collect metrics successfully. 
+
+.. Create a user on the production cluster that has the 
+`remote_monitoring_collector` {stack-ov}/built-in-roles.html[built-in role]. 
+Alternatively, use the `remote_monitoring_user` 
+{stack-ov}/built-in-users.html[built-in user].
+
+.. Add the `username` and `password` settings to the {kib} module configuration 
+file.
++
+--
+For example, add the following settings in the `modules.d/kibana.yml` file:
+
+[source,yaml]
+----------------------------------
+- module: kibana
+  ...
+  username: remote_monitoring_user
+  password: YOUR_PASSWORD
+----------------------------------
+--
+
+. If you configured {kib} to use
+{kibana-ref}/configuring-tls.html[encrypted communications], you must access it
+via HTTPS. For example, use a `hosts` setting like 
+`https://localhost:5601` in the `modules.d/kibana.yml` file. 
+
+. Identify where to send the {kib} monitoring data and supply the necessary
+security information. Add the following settings in the {metricbeat} 
+configuration file (`metricbeat.yml`):
++
+--
+[source,yaml]
+----------------------------------
+  output.elasticsearch:
+    hosts: ["MONITORING_ELASTICSEARCH_URL"] <1>
+    username: cloud_monitoring_agent
+    password: MONITORING_AGENT_PASSWORD <2>
+----------------------------------
+<1> Replace `MONITORING_ELASTICSEARCH_URL` with the appropriate URL from the ESMS.
+<2> Replace `MONITORING_AGENT_PASSWORD` with the value provided to you by the
+  Elastic support team.
+--
+
+. {metricbeat-ref}/metricbeat-starting.html[Start {metricbeat}]. 
+
+////
+To use HTTP exporters:
+TBD
+
+
+[discrete]
+[[esms-logstash]]
+=== Collecting monitoring data about {ls}
+
 . (Optional)
 {logstash-ref}/configuring-logstash.html[Configure {ls} to collect data and send it to the monitoring cluster]. 
 +
@@ -136,10 +285,10 @@ data to ESMS. It cannot be accomplished by using {metricbeat}.
 
 --
 
-. (Optional) Configure {kib} to collect data and send it to the monitoring cluster:
-** {kibana-ref}/monitoring-metricbeat.html[Use {metricbeat}]. This 
-option is available in 6.4 and later versions. 
-** {kibana-ref}/monitoring-kibana.html[Use HTTP exporters].
+[[esms-view]]
+=== Viewing monitoring data
 
-. View the monitoring data by logging into {kib} on ESMS. For more information,
-see {kibana-ref}/xpack-monitoring.html[Monitoring]. 
+You can view the monitoring data by logging into {kib} on ESMS. The {kib} URL is
+provided by the Elastic support team. For more information about the monitoring
+interface in {kib}, see {kibana-ref}/xpack-monitoring.html[Monitoring]. 
+////