I have read through numerous posts on this issue, but between the fixes being somewhat vague, and my lack of knowledge in the graylog, and ubuntu world, have been unable to resolve the issue.
I have tried (possibly incorrectly) to add the action.auto_create_index: false to the elasticsearch.yml file. I have removed the deflector indice, but it repopulates within a minute or so. I am sure others will need some more info to help me diagnose the issue, and if you are willing to point me in the direction of what is needed, and how to get it, I will gladly acquire such info.
What I do know is I am running this on a VM with Ubuntu 16.04.5 LTS. I followed the instructions on docs.graylog.org/en/2.4/pages/installation/os/ubuntu.html I should be running some vesion of 2.4 for GL, and 5.X for elastic search. Mongo DB should be up to date.