According to Graylog installation guide we need to customize /etc/elasticsearch/elasticsearch.yml “additionally you need to uncomment (remove the # as first character) the line, and add
action.auto_create_index: false to the configuration file”
What’s the meaning and impact of this setting?
Recently I updated ES to 6.6.1 and it failed to start with error
java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [false] is too restrictive. disable [action.auto_create_index] or set it to [.watches,.triggered_watches,.watcher-history-*]
so I had to remove this setting