# Elasticsearch configuration for graylog action.auto\_create\_index: false throwing error

**URL:** <https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412>\
**Category:** Graylog Central (peer support)\
**Created:** [April 15, 2022, 9:20pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412 "2022-04-15T21:20:40Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 15, 2022, 9:20pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/1 "2022-04-15T21:20:40Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

I am trying to install elasticsearch and add graylog specific configuration to it.  
I am following below official document.  
[https://docs.graylog.org/v1/docs/centos](https://docs.graylog.org/v1/docs/centos)

sudo tee -a /etc/elasticsearch/elasticsearch.yml \> /dev/null \<\<EOT  
cluster.name: graylog  
action.auto\_create\_index: false  
EOT

But action.auto\_create\_index: false this configuration is not working and elasticsearch fails with the error thats its too restrictive.  
Its throwing error.

When I am removing action.auto\_create\_index: false the elasticsearch is starting normally.

**2. Describe your environment:**

- OS Information: CentOS Linux release 8.4.2105

- Package Version: 4.2

- Service logs, configurations, and environment variables:  
Elastic search 7.10.0  
Mongo 4.2  
Java 1.8.0

**3. What steps have you already taken to try and solve the problem?**

I removed action.auto\_create\_index: false from configuration file and elasticsearch started running fine.

**4. How can the community help?**  
Why elasticsearch not working with autocreateindex false? How to solve this?  
Is it ok to remove index parameters and run graylog?

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [April 15, 2022, 10:22pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/2 "2022-04-15T22:22:44Z")

</div>

Hello && Welcome @spandey

I might be able to help.

> [@spandey](#):
>
> But action.auto\_create\_index: false this configuration is not working and elasticsearch fails with the error thats its too restrictive.  
> Its throwing error.

We would need to see this error in its full glory.

> [@spandey](#):
>
> Why elasticsearch not working with autocreateindex false?

Can you show Elasticsearch/Graylog log files when this issue occurs?

```auto
/var/log/elasticsearch/
/var/log/graylog-server

```

If possible show us _elasticsearch.yml_ file configuration?

`cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"`

Just an FYI instead of using that command to configure the elasticsearch YAML file, try manually configuring it like so…

` vi /etc/elasticsearch/elasticsearch.yml`

Then type in the following and notice the spacing.

`action.auto_create_index: false`

Results:

```auto
[root@graylog graylog]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"
cluster.name: graylog
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 8.8.8.8
http.port: 9200
action.auto_create_index: false
discovery.type: single-node
[root@graylog graylog]#

```

Remember to restart Elasticsearch when done.

`systemctl restart elasticsearch`

> [@spandey](#):
>
> Is it ok to remove index parameters and run graylog?

**action.auto\_create\_index** is there to prevent Elasticsearch from automatically creating indices when asked to index documents into an index that doesn’t currently exist. Graylog wants to be in control of creating indices so it can set up the deflector aliases properly, so if you have disabled that setting at some point a message will be indexed to the deflector alias, which may not exist yet, and Elasticsearch will create it as an index which will stop the index rotation cold.

**Elasticsearch documentation.**

> Automatic index creation is controlled by the action.auto\_create\_index setting. This setting defaults to true, which allows any index to be created automatically. You can modify this setting to explicitly allow or block automatic creation of indices that match specified patterns, or set it to false to disable automatic index creation entirely

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 16, 2022, 9:50pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/5 "2022-04-16T21:50:42Z")

</div>

I am editing the elasticsearch.yml file using vim.  
I didnt use cat .

I am not able to send java exception logs here ., my post is getting hidden.

Below is part of the error.

`Caused by: java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [false] is too restrictive. disable [action.auto_create_index] or set it to [.watches,.triggered_watches,.watcher-history-*]`

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [April 18, 2022, 10:35pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/6 "2022-04-18T22:35:27Z")

</div>

The following works in my lab, so I’m not sure why your having issues.

`action.auto_create_index: false`

I also Found these post. it may help understand why this is happening, Unfortunately I can not reproduce this issue in my lab.

- [Cannot disable autoCreateIndex · Issue #92 · alexcojocaru/elasticsearch-maven-plugin · GitHub](https://github.com/alexcojocaru/elasticsearch-maven-plugin/issues/92)
- [Can't set action.auto\_create\_index to any value(too restrictive) · Issue #33369 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/33369)

EDIT:

> [@spandey](#):
>
> I am not able to send java exception logs here ., my post is getting hidden.

Not sure what going on there. What I was asking was to see you Elasticsearch file. and post it here using this command as I showed above.

> [@gsmith](#):
>
> If possible show us _elasticsearch.yml_ file configuration?
> 
> `cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"`

> [@spandey](#):
>
> Below is part of the error.

I would need to see full logs. With out more data, I cant give you a direct answer.

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:04am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/7 "2022-04-19T05:04:06Z")

</div>

```auto
[root@j3chyvmsysl01 tmp]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: graylog

JAVA error

> [2022-04-16T03:12:55,869][INFO][o.e.n.Node] [j3chyvmsysl01] version[7.10.0], pid[1458884], build[default/rpm/51e9d6f22758d0374a0f3f5c6e8f3a7997850f96/2020-11-09T21:30:33.964949Z], OS[Linux/4.18.0-305.3.1.el8.x86_64/amd64], JVM[AdoptOpenJDK/OpenJDK 64-Bit Server VM/15.0.1/15.0.1+9]
> [2022-04-16T03:12:55,872][INFO][o.e.n.Node] [j3chyvmsysl01] JVM home [/usr/share/elasticsearch/jdk], using bundled JDK [true]
> [2022-04-16T03:12:55,873][INFO][o.e.n.Node] [j3chyvmsysl01] JVM arguments [-Xshare:auto, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -Xms1g, -Xmx1g, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/elasticsearch-18171107793140923621, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/elasticsearch, -XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -XX:MaxDirectMemorySize=536870912, -Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/etc/elasticsearch, -Des.distribution.flavor=default, -Des.distribution.type=rpm, -Des.bundled_jdk=true]
> [2022-04-16T03:12:58,805][ERROR][o.e.b.Bootstrap] [j3chyvmsysl01] Exception
> java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.watcher.Watcher]
> at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:722) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:658) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:479) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:168) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.node.Node.<init>(Node.java:346) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.node.Node.<init>(Node.java:289) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:227) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:227) ~[elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) [elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) [elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) [elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) [elasticsearch-cli-7.10.0.jar:7.10.0]
> at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.10.0.jar:7.10.0]
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.10.0.jar:7.10.0]
> Caused by: java.lang.reflect.InvocationTargetException
> at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
> at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:64) ~[?:?]
> at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
> at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
> at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
> at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:715) ~[elasticsearch-7.10.0.jar:7.10.0]
> ... 15 more
> Caused by: java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [false] is too restrictive. disable [action.auto_create_index] or set it to [.watches,.triggered_watches,.watcher-history-*]
> at org.elasticsearch.xpack.watcher.Watcher.validAutoCreateIndex(Watcher.java:616) ~[?:?]
> at org.elasticsearch.xpack.watcher.Watcher.<init>(Watcher.java:248) ~[?:?]
> at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
> at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:64) ~[?:?]
> at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
> at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
> at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
> at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:715) ~[elasticsearch-7.10.0.jar:7.10.0]
> ... 15 more

```

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:05am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/8 "2022-04-19T05:05:39Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/48afb74271d1b1e37a2348ef20797718937c0427.png)  
I have uploaded a snippet of the error.

Below is elastic configuration.

```auto
[root@j3chyvmsysl01 tmp]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: graylog

```

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:08am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/9 "2022-04-19T05:08:06Z")

</div>

- [Can’t set action.auto\_create\_index to any value(too restrictive) · Issue #33369 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/33369)

This is the issue I am also facing.

index too restrictive.  
I tried adding java error but it is keep on getting hidden.

Below is elastic configuration.

```auto
[root@j3chyvmsysl01 tmp]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: graylog
[root@j3chyvmsysl01 tmp]#

```

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:08am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/10 "2022-04-19T05:08:21Z")

</div>

```auto
[root@j3chyvmsysl01 tmp]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v "^\s*(#|$)"
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
cluster.name: graylog
[root@j3chyvmsysl01 tmp]#

```

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:09am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/11 "2022-04-19T05:09:48Z")

</div>

[root@j3chyvmsysl01 tmp]# cat /etc/elasticsearch/elasticsearch.yml | egrep -v “^\s\*(#|$)”  
path.data: /var/lib/elasticsearch  
path.logs: /var/log/elasticsearch  
cluster.name: graylog  
[root@j3chyvmsysl01 tmp]#

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [April 19, 2022, 5:10am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/12 "2022-04-19T05:10:27Z")

</div>

I am not able to post any comment. Every logs or configuration is going for hidden.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [April 20, 2022, 11:04pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/13 "2022-04-20T23:04:06Z")

</div>

Hello,

Can you post this command here?

`curl -XGET http://localhost:9200/`

I see there are double post perhaps its a Network/Browser issue?

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [May 2, 2022, 6:56pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/14 "2022-05-02T18:56:57Z")

</div>

Hi,  
Yes multiple post has been done because the portal was not accepting my messages.  
I will check the localhost and will get back to you.  
Thanks!

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [May 6, 2022, 3:38am UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/15 "2022-05-06T03:38:09Z")

</div>

> [@gsmith](#):
>
> curl -XGET [http://localhost:9200/](http://localhost:9200/)

[root@j3chyvmsysl01 certs]# curl -XGET [http://localhost:9200/](http://localhost:9200/)  
{  
“name” : “j3chyvmsysl01”,  
“cluster\_name” : “graylog”,  
“cluster\_uuid” : “EtTRfDsCRfSj-qDKrGWWgw”,  
“version” : {  
“number” : “7.10.0”,  
“build\_flavor” : “default”,  
“build\_type” : “rpm”,  
“build\_hash” : “51e9d6f22758d0374a0f3f5c6e8f3a7997850f96”,  
“build\_date” : “2020-11-09T21:30:33.964949Z”,  
“build\_snapshot” : false,  
“lucene\_version” : “8.7.0”,  
“minimum\_wire\_compatibility\_version” : “6.8.0”,  
“minimum\_index\_compatibility\_version” : “6.0.0-beta1”  
},  
“tagline” : “You Know, for Search”  
}

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [May 6, 2022, 10:42pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/16 "2022-05-06T22:42:57Z")

</div>

I see you not use elasticsearch-oss, is this correct?

> [@spandey](#):
>
> “number” : “7.10.0”,  
> “build\_flavor” : “default”,

What do you get when you run this command.

`curl -XGET http://localhost:9200/_cluster/health?pretty`

---

<div class="post-metadata">

**Author:** ![spandey](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@spandey](https://community.graylog.org/u/spandey)\
**Post date:** [May 9, 2022, 1:44pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/17 "2022-05-09T13:44:38Z")

</div>

I will look into it @gsmith.  
Currently looking into troubleshooting a separate issue related to HTTPS configuration.  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 23, 2022, 1:45pm UTC](https://community.graylog.org/t/elasticsearch-configuration-for-graylog-action-auto-create-index-false-throwing-error/23412/18 "2022-05-23T13:45:09Z")

</div>

Closed on May 23, 2022, 1:45pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.