diff --git a/build/tasks/arm-validator.js b/build/tasks/arm-validator.js
index 5b46e4f8..e3f401ac 100644
--- a/build/tasks/arm-validator.js
+++ b/build/tasks/arm-validator.js
@@ -157,7 +157,7 @@ var login = (cb) => {
   var version = [ '--version' ];
   az(version, (error, stdout, stderr) => {
     // ignore stderr if it's simply a warning about an older version of Azure CLI
-    if (error || (stderr && !/^WARNING: You have \d+ updates available/.test(stderr))) {
+    if (error || (stderr && !/^WARNING: You have \d+ updates available/.test(stderr) && !/Unable to check if your CLI is up-to-date. Check your internet connection./.test(stderr))) {
       return bailOut(error || new Error(stderr));
     }
 
diff --git a/src/scripts/logstash-install.sh b/src/scripts/logstash-install.sh
index 5f2830e4..8e150976 100644
--- a/src/scripts/logstash-install.sh
+++ b/src/scripts/logstash-install.sh
@@ -271,24 +271,17 @@ configure_logstash_yaml()
     echo "path.logs: $LOG_PATH" >> $LOGSTASH_CONF
     echo "log.level: error" >> $LOGSTASH_CONF
 
-    # install x-pack
-    if [[ $INSTALL_XPACK -ne 0 ]]; then
-      if dpkg --compare-versions "$LOGSTASH_VERSION" "lt" "7.0.0"; then
-        echo 'xpack.monitoring.elasticsearch.url: "${ELASTICSEARCH_URL}"' >> $LOGSTASH_CONF
-      else
-        echo 'xpack.monitoring.elasticsearch.hosts: ["${ELASTICSEARCH_URL}"]' >> $LOGSTASH_CONF
-      fi
+    # configure monitoring
+    if dpkg --compare-versions "$LOGSTASH_VERSION" "lt" "7.0.0"; then
+      echo 'xpack.monitoring.elasticsearch.url: "${ELASTICSEARCH_URL}"' >> $LOGSTASH_CONF
+    else
+      echo 'xpack.monitoring.elasticsearch.hosts: ["${ELASTICSEARCH_URL}"]' >> $LOGSTASH_CONF
+    fi
 
-      # assumes Security is enabled, so configure monitoring credentials
+    # configure monitoring credentials
+    if [[ $INSTALL_XPACK -ne 0 || $BASIC_SECURITY -ne 0 ]]; then
       echo "xpack.monitoring.elasticsearch.username: logstash_system" >> $LOGSTASH_CONF
       echo 'xpack.monitoring.elasticsearch.password: "${LOGSTASH_SYSTEM_PASSWORD}"' >> $LOGSTASH_CONF
-    else
-      # configure monitoring for basic
-      if dpkg --compare-versions "$LOGSTASH_VERSION" "lt" "7.0.0"; then
-        echo 'xpack.monitoring.elasticsearch.url: "${ELASTICSEARCH_URL}"' >> $LOGSTASH_CONF
-      else
-        echo 'xpack.monitoring.elasticsearch.hosts: ["${ELASTICSEARCH_URL}"]' >> $LOGSTASH_CONF
-      fi
     fi
 
     local MONITORING='true'
@@ -320,9 +313,9 @@ configure_logstash_yaml()
             log "[configure_logstash_yaml] CA cert extracted from HTTP PKCS#12 archive. Make ELASTICSEARCH_CACERT available to conf files"
             add_keystore "ELASTICSEARCH_CACERT" "$SSL_PATH/elasticsearch-http-ca.crt"
 
-            # logstash performs hostname verification for monitoring
+            # logstash performs hostname verification for monitoring when verification_mode:certificate is used,
             # which will not work for a HTTP cert provided by the user, where logstash communicates through internal loadbalancer.
-            # 6.4.0 exposes verification_mode, so set this to none and document.
+            # 6.4.0 exposes verification_mode, so set to none to allow monitoring, and document.
             if dpkg --compare-versions "$LOGSTASH_VERSION" "ge" "6.4.0"; then
               if dpkg --compare-versions "$LOGSTASH_VERSION" "lt" "7.0.0"; then
                 echo 'xpack.monitoring.elasticsearch.ssl.ca: "${ELASTICSEARCH_CACERT}"' >> $LOGSTASH_CONF