# Failed to create monitoring event
**URL:** https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876
**Category:** Logstash
**Created:** [February 13, 2017, 12:06pm UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876 "2017-02-13T12:06:26Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@shubhrant](https://discuss.elastic.co/u/shubhrant)
#### Post date: [February 13, 2017, 12:06pm UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/1 "2017-02-13T12:06:26Z")
after configuring the X-PACK logstash is not processing the the logs
configuration of logstash
input {
tcp {
port =\> 5044
charset =\> "ISO-8859-1"
}
}
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog$
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
stdout { codec =\> rubydebug }
elasticsearch { hosts =\> ["localhost:9200"] }
}
and the error which logstash is giving i.e.
[2017-02-13T17:32:17,649][ERROR][logstash.inputs.metrics] Failed to create monitoring event {:message=\>"For path: events", :error=\>"LogStash::Instrument::MetricStore::MetricNotFound"}
before X-pack everything was working fine
---
### Author:  [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)
#### Post date: [February 13, 2017, 8:27pm UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/2 "2017-02-13T20:27:51Z")
Did you add this property to elasticsearch.yml file?
`action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*`
---
### Author:  [@shubhrant](https://discuss.elastic.co/u/shubhrant)
#### Post date: [February 14, 2017, 4:49am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/3 "2017-02-14T04:49:16Z")
thanks for your response krishna
yes I've added this my elasticsearch.yml file is :slight\_smile :
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# [https://www.elastic.co/guide/en/elasticsearch/reference/index.html](https://www.elastic.co/guide/en/elasticsearch/reference/index.html)
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#[cluster.name](http://cluster.name): my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
# [node.name](http://node.name): node-1
#
# Add custom attributes to the node:
#
# node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
# bootstrap.memory\_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: localhost
#
# Set a custom port for HTTP:
#
# http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
# discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
# discovery.zen.minimum\_master\_nodes: 3
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
# gateway.recover\_after\_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
# action.destructive\_requires\_name: true
action.auto\_create\_index: .security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*
"NOTE-----the bold character is hashed"
but still the same error is coming
---
### Author:  [@Charles.w](https://discuss.elastic.co/u/Charles.w)
#### Post date: [February 14, 2017, 7:59am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/4 "2017-02-14T07:59:59Z")
Did you can any message at logstash startup ? If you got something like "[2017-02-...][ERROR][logstash.agent] fetched an invalid config { ... }" and then you got this message, this could mean you ran into the same error as discussed here : [Logstash Failed to create monitoring event](https://discuss.elastic.co/t/logstash-failed-to-create-monitoring-event/74191)
If so, you should fix your config, and try again. This message should disappear.
---
### Author:  [@shubhrant](https://discuss.elastic.co/u/shubhrant)
#### Post date: [February 14, 2017, 8:46am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/5 "2017-02-14T08:46:19Z")
this is my kibana monitoring dashboard
and this is the logstash service status msg . it is running
I think the logstash configuration is fine because I didn't make any changes in that
and the error msg is showing like
"[2017-02-14T15:00:10,264][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>404, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2017.02.14", :\_type=\>"syslog", :\_routing=\>nil}, 2017-02-14T09:30:35.000Z shubhrant Feb 14 15:00:35 shubhrant kernel: [19773.952596] [UFW BLOCK] IN=enp0s25 OUT= MAC=01:00:5e:00:00:fc:6c:c2:17:ee:78:21:08:00 SRC=10.228.13.181 DST=224.0.0.252 LEN=50 TOS=0x00 PREC=0x00 TTL=1 ID=26941 PROTO=UDP SPT=54248 DPT=5355 LEN=30 ], :response=\>{"index"=\>{"\_index"=\>"logstash-2017.02.14", "\_type"=\>"syslog", "\_id"=\>nil, "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception", "reason"=\>"no such index", "resource.type"=\>"index\_expression", "resource.id"=\>"logstash-2017.02.14", "index\_uuid"=\>"_na_", "index"=\>"logstash-2017.02.14"}}}} "
---
### Author:  [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)
#### Post date: [February 14, 2017, 3:16pm UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/6 "2017-02-14T15:16:39Z")
I remembered solving this by appending `logstash*` to `action.auto_create_index` parameter. May be that could solve.
---
### Author:  [@shubhrant](https://discuss.elastic.co/u/shubhrant)
#### Post date: [February 15, 2017, 4:52am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/7 "2017-02-15T04:52:11Z")
> [@krishna\_chaitanya](#):
>
> appending logstash\* to action.auto\_create\_index
thanks krishna But after appending logstash\* the elastic service is getting stop, it is not starting
---
### Author:  [@shubhrant](https://discuss.elastic.co/u/shubhrant)
#### Post date: [February 17, 2017, 6:26am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/8 "2017-02-17T06:26:10Z")
is there anybody to help in this ............
please ☹
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 17, 2017, 6:26am UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event/74876/9 "2017-03-17T06:26:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.