For ELK,sometimes Logstash says “no such index”, how to set automatic create index in ES while “no such index”?

Elastic Stack Logstash
1

I found some pb with ELK, can anyone help me? thanks!

logstash 2.4.0
elasticsearch 2.4.0
3 elasticsearch instance for cluster

some time logstash warning
“ "status"=>404, "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such index", ...”,
and it doesn't work. curl -XGET ES indices, it truly not have the index. when this happen, i must kill -9 logstash, and start it again, then it can create a index in ES and it works ok again.

so, my question is how to set automatic create index in ES while “no such index”?

my logstash conf is:

input {
tcp {
port => 10514
codec => "json"
}
}

output {
elasticsearch {
hosts => [ "9200.xxxxxx.com:9200" ]
index => "log001-%{+YYYY.MM.dd}"
}

2

this often happen in the new day , "{+YYYY.MM.dd} " .....
and this time there is no error log in ES.
only logstash seems in pb.

3

Can you trace exactly which HTTP request that fails? Use e.g. Wireshark or Packetbeat. Elasticsearch should normally create indexes automatically as part of indexing requests.

4

OK,I will trace it by Wireshark next time ,thanks !