Cannot create index after installing x-pack

Hi , I am not able to create index after installing x-pack, I keep getting this error :
"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"studentInfo","index_uuid":"na","index":"studentInfo"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"studentInfo","index_uuid":"na","index":"studentInfo"},"status":404}

my .conf file is
output{
stdout { codec => json_lines }
elasticsearch{
#protocol => "http"
"hosts" => "localhost:9200"
"user" => elastic
"password" => changeme
"index" => "studentInfo"
"document_type" => "data"
}
}

Please Help
Thanks in advance
Bhavna Jha

Not sure what is the relationship with x-pack.

Where exactly this error message is coming from?

Hi David,

I installed x-pack also included the user and password in my conf file but as soon as i try to create index pattern using logstash i get index_not_found_exception.

I have connected mySQL to elasticsearch through logstash.

Did you follow the steps described there?

https://www.elastic.co/guide/en/x-pack/current/logstash.html

It looks like you have configured action.auto_create_index to be too restrictive.

The X-Pack installation instructions advise you to modify that setting "If you have disabled automatic index creation in Elasticsearch", but it doesn't sound like that is true for you.

You best solution is going to be to remove that setting from your elasticsearch.yml, unless you have a particular need for it, then you can just leave it as the default (unspecified) value which will allow all indices to be created.

If you have a specific reason to set it, then you will need make sure you include logstash-* in the list of allowed indices.

@TimV I did remove action.auto_create_index from my elasticsearch.yml but still getting same 404 error on creating index via logstash.

Do I need to include something explicitly in elasticsearch.yml or kibana.yml ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.