# Getting Error in Elasticsearch 8.12 version

**URL:** <https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371>\
**Category:** Elasticsearch\
**Created:** [February 2, 2024, 8:01am UTC](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371 "2024-02-02T08:01:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashishshukla](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@ashishshukla](https://discuss.elastic.co/u/ashishshukla)\
**Post date:** [February 2, 2024, 8:01am UTC](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371/1 "2024-02-02T08:01:36Z")

</div>

I am getting error while starting the Elasticsearch please provide the solution for this.

**Error**  
java.lang.IllegalArgumentException: unknown setting [xpack.security.audit.logfile.events.ignore\_filters.users] please check that any required plugins are installed, or check the breaking changes documentation for removed settings

**Configuration for elasticsearch.yml file**

# ---------------------------------- Cluster -----------------------------------

# 

# Use a descriptive name for your cluster:

# 

cluster.name: my-application

# 

# ------------------------------------ Node ------------------------------------

# 

# Use a descriptive name for the node:

# 

node.name: node1

# 

# Add custom attributes to the node:

# 

#node.attr.rack: r1

# 

# ----------------------------------- Paths ------------------------------------

# 

# Path to directory where to store the data (separate multiple locations by comma):

# 

path.data: /var/lib/elasticsearch

# 

# Path to log files:

# 

path.logs: /var/log/elasticsearch

# 

# ----------------------------------- Memory -----------------------------------

# 

# Lock the memory on startup:

# 

#bootstrap.memory\_lock: true

# 

# Make sure that the heap size is set to about half the memory available

# on the system and that the owner of the process is allowed to use this

# limit.

# 

# Elasticsearch performs poorly when the system is swapping the memory.

# 

# ---------------------------------- Network -----------------------------------

# 

# By default Elasticsearch is only accessible on localhost. Set a different

# address here to expose this node on the network:

# 

network.host: [lit4elastic81.fyre.ibm.com](http://lit4elastic81.fyre.ibm.com)

# 

# By default Elasticsearch listens for HTTP traffic on the first free port it

# finds starting at 9200. Set a specific HTTP port here:

# 

http.port: 9200

# 

# For more information, consult the network module documentation.

# 

# --------------------------------- Discovery ----------------------------------

# 

# Pass an initial list of hosts to perform discovery when this node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

# 

#discovery.seed\_hosts: ["host1", "host2"]

# 

# Bootstrap the cluster using an initial set of master-eligible nodes:

# 

#cluster.initial\_master\_nodes: ["node-1", "node-2"]

# 

# For more information, consult the discovery and cluster formation module documentation.

# 

# ---------------------------------- Various -----------------------------------

# 

# Allow wildcard deletion of indices:

# 

#action.destructive\_requires\_name: false

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------

# 

# The following settings, TLS certificates, and keys have been automatically

# generated to configure Elasticsearch security features on 17-01-2024 16:24:36

# 

# --------------------------------------------------------------------------------

# Enable security features

xpack.security.enabled: true

xpack.security.enrollment.enabled: true  
xpack.security.audit.enabled : true  
xpack.security.audit.logfile.events.include: ["authentication\_success","authentication\_failed"]  
xpack.security.audit.logfile.events.emit\_request\_body : true  
xpack.security.audit.logfile.emit\_node\_name : true  
xpack.security.audit.logfile.emit\_node\_host\_address : true  
xpack.security.audit.logfile.emit\_node\_host\_name: true  
xpack.security.audit.logfile.emit\_node\_id: true  
xpack.license.self\_generated.type: trial

xpack.security.audit.logfile.events.ignore\_filters:  
users: ["kibana\_system", "\_system"]  
indices: ["app-logs\*"]

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents

xpack.security.http.ssl:  
enabled: false

# keystore.path: elastic-certificates.p12

# verification\_mode: certificate

# Enable encryption and mutual authentication between cluster nodes

xpack.security.transport.ssl:  
enabled: false

# verification\_mode: certificate

# keystore.path: elastic-certificates.p12

# truststore.path: elastic-certificates.p12

# client\_authentication: required

# Create a new cluster with the current node only

# Additional nodes can still join the cluster later

# cluster.initial\_master\_nodes: ["[lit4elastic81.fyre.ibm.com](http://lit4elastic81.fyre.ibm.com)"]

discovery.type: single-node

# Allow HTTP API connections from anywhere

# Connections are encrypted and require user authentication

http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere

# Connections are encrypted and mutually authenticated

#transport.host: 0.0.0.0

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------  
#logger.org.elasticsearch.discovery: DEBUG

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 2, 2024, 8:07am UTC](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371/2 "2024-02-02T08:07:34Z")

</div>

Hi @ashishshukla,

> [@ashishshukla](#):
>
> java.lang.IllegalArgumentException: unknown setting [xpack.security.audit.logfile.events.ignore\_filters.users]

The issue looks to be your configuration for the setting `xpack.security.audit.logfile.events.ignore_filters.users` that you have included in your documentation.

You need to include a namespace as shown in the [examples in the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-log-ignore-policy.html).

Can you try that and see if that resolves your error?

Hope that helps!

.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2024, 8:08am UTC](https://discuss.elastic.co/t/getting-error-in-elasticsearch-8-12-version/352371/3 "2024-03-01T08:08:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.