# Failed to create event
**URL:** https://discuss.elastic.co/t/failed-to-create-event/86006
**Category:** Logstash
**Created:** [May 16, 2017, 8:32pm UTC](https://discuss.elastic.co/t/failed-to-create-event/86006 "2017-05-16T20:32:32Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@craftytech1](https://discuss.elastic.co/u/craftytech1)
#### Post date: [May 16, 2017, 8:32pm UTC](https://discuss.elastic.co/t/failed-to-create-event/86006/1 "2017-05-16T20:32:32Z")
using ELK stack 5.3. I'm getting the following error message: **[ERROR][logstash.inputs.metrics] Failed to create monitoring event {:message=\>"For path: events", :error=\>"LogStash::Instrument::MetricStore::MetricNotFound"}**
I just added x-pack security with AD to the stack. I can login from kibana using AD credentials, I can curl values using the internal credentials 'logstash\_system'.
curl -u logstash\_system:xyz123pass '[http://localhost:9200/\_xpack/security/\_authenticate?pretty=true](http://localhost:9200/_xpack/security/_authenticate?pretty=true)'
{
"username" : "logstash\_system",
"roles" : [
"logstash\_system"
],
"full\_name" : null,
"email" : null,
"metadata" : {
"\_reserved" : true
},
"enabled" : true
}
So that works. These are my logstash config files:
cat /etc/logstash/conf.d/02-beats-input.conf
input {
beats {
port =\> 5044
user =\> logstash\_system
password =\> xyz123pass
}
}
cat /etc/logstash/conf.d/10-syslog-filter.conf
filter {
user =\> logstash\_system
password =\> xyz123pass
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
cat /etc/logstash/conf.d/30-elasticsearch-output.conf
output {
elasticsearch {
hosts =\> "[http://localhost:9200](http://localhost:9200)"
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][type]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
user =\> logstash\_system
password =\> xyz123pass
}
}
Everything was working fine before I added the x-pack security. This is the actual logstash config:
cat /etc/logstash/logstash.yml| grep -v '#'
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
path.logs: /var/log/logstash
xpack.monitoring.elasticsearch.url: "[http://localhost:9200](http://localhost:9200)"
xpack.monitoring.elasticsearch.username: logstash\_system
xpack.monitoring.elasticsearch.password: xyz123pass
Can someone help out with this issue?
---
### Author:  [@craftytech1](https://discuss.elastic.co/u/craftytech1)
#### Post date: [May 17, 2017, 2:10pm UTC](https://discuss.elastic.co/t/failed-to-create-event/86006/2 "2017-05-17T14:10:06Z")
I followed this guide: [https://www.elastic.co/guide/en/x-pack/5.3/index.html](https://www.elastic.co/guide/en/x-pack/5.3/index.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2017, 2:10pm UTC](https://discuss.elastic.co/t/failed-to-create-event/86006/3 "2017-06-14T14:10:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.