I am using my Elasticsearch cluster/node also for other apps than Graylog.
For that I need action.auto_create_index set to true so they continue to work.
As this is going to make problems with Graylog apparently the question for me is which indexnames have to be excluded there.
Is it enough to set it to
action.auto_create_index: -graylog*
or are there any other names involved in internal Graylog handling?