ElasticSearch crashing due to auto_create_index problem

I have ElasticSearch running on a separate server. Both servers are RHEL 8, install via RPM seemed to go without a hitch. However, the instruction in the Graylog installation:

Causes the following error in the log and then Elasticsearch crashes: action.auto_create_index: false

Caused by: java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [false] is too restrictive. disable [action.auto_create_index] or set it to [.watches,.triggered$

For now I’ve disabled it, and the system is up and running. Am I good to leave it disabled?

You have installed the Elasticsearch version including x-pack/elastic licensed plugins. While the documentation refers to the OSS Version of Elasticsearch without that plugins.

The setting in this way is working on the OSS packages - when you have the x-pack included elasticsearch you need to adjust like the log suggest.

Thank you. Which one of the settings is most appropriate? For now it is disabled.

you should only install the Elasticsearch Version with X-Pack if you really have a reason for that. Otherwise use the OSS Version.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.