# Elasticsearch stops receiving logstash messages after installing x-pack

**URL:** https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985
**Category:** Elasticsearch
**Created:** [January 27, 2017, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985 "2017-01-27T07:52:57Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ckessing](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@ckessing](https://discuss.elastic.co/u/ckessing)
#### Post date: [January 27, 2017, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985/1 "2017-01-27T07:52:57Z")

</div>

Hi,  
After successfully installing and monitoring x-pack, elasticsearch stops receiving messages from logstash at 23:59:59.  
action.auto\_create\_index: .security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.logstash\* is configured at elasticsearch.yml.  
Does any body have an idea?  
Cheers  
CK

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 27, 2017, 7:54am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985/2 "2017-01-27T07:54:59Z")

</div>

Did you add auth settings to LS?

---

<div class="post-metadata">

### Author: ![ckessing](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@ckessing](https://discuss.elastic.co/u/ckessing)
#### Post date: [January 27, 2017, 8:37am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985/3 "2017-01-27T08:37:07Z")

</div>

Forgot to mention it's the free version of x-pack. So only monitoring is active.  
But nevertheless it doesn't matter if I add user and password to the logstash config file.  
Weird because elasticsearch is receiving from logstash until 23:59:59.

---

<div class="post-metadata">

### Author: ![ckessing](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@ckessing](https://discuss.elastic.co/u/ckessing)
#### Post date: [February 7, 2017, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985/4 "2017-02-07T08:32:51Z")

</div>

After installing x-pack 5.1.2 and DELETING the line action.auto\_create\_index it's working now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2017, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-stops-receiving-logstash-messages-after-installing-x-pack/72985/5 "2017-03-07T08:33:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
