# Index 404 error in logstash
**URL:** https://discuss.elastic.co/t/index-404-error-in-logstash/91830
**Category:** Logstash
**Created:** [July 5, 2017, 3:53am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830 "2017-07-05T03:53:10Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@mkain](https://discuss.elastic.co/u/mkain)
#### Post date: [July 5, 2017, 3:53am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830/1 "2017-07-05T03:53:10Z")
I have started getting following error in logstash. I had installed x-pack on on 3 ELK components and it was working fine for a while. but after few hours I started getting following error.
I have even tried to remove x-pack from all 3 ELK components and restarted ELK but I still see this error. can someone please guide me to resolve it ?
[2017-07-05T09:20:10,609][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>404, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2017.07.05", :\_type=\>"syslog", :\_routing=\>nil}, 2017-07-05T03:50:10.577Z 10.91.142.103 \<179\>Jul 5 09:20:10 10.91.126.1 TMNX: 45006214 Base PORT-MINOR-etherAlarmSet-2017 [Port 5/2/4]: Alarm Remote Fault Set], :response=\>{"index"=\>{"\_index"=\>"logstash-2017.07.05", "\_type"=\>"syslog", "\_id"=\>nil, "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception", "reason"=\>"no such index and [action.auto\_create\_index] ([.security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*]) doesn't match", "index\_uuid"=\>"_na_", "index"=\>"logstash-2017.07.05"}}}}
[2017-07-05T09:20:10,610][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>404, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2017.07.05", :\_type=\>"syslog", :\_routing=\>nil}, 2017-07-05T03:50:10.579Z 10.91.142.103 \<179\>Jul 5 09:20:10 10.91.126.1 TMNX: 45006215 Base PORT-MINOR-etherAlarmClear-2018 [Port 5/2/4]: Alarm Local Fault Cleared], :response=\>{"index"=\>{"\_index"=\>"logstash-2017.07.05", "\_type"=\>"syslog", "\_id"=\>nil, "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception", "reason"=\>"no such index and [action.auto\_create\_index] ([.security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*]) doesn't match", "index\_uuid"=\>"_na_", "index"=\>"logstash-2017.07.05"}}}}
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 5, 2017, 5:15am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830/2 "2017-07-05T05:15:25Z")
The most likely cause is that your `action.auto_create_index` setting is too restrictive.
Does your `elasticsearch.yml` contain a value for that setting?
See: [https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index\_.html#index-creation](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html#index-creation)
The X-Pack [install instructions](https://www.elastic.co/guide/en/x-pack/5.4/installing-xpack.html#installing-xpack) advise to set that value _If you have disabled automatic index creation_. Generally speaking, you're better off leaving at the default value which enables all indices to be automatically created.
---
### Author:  [@mkain](https://discuss.elastic.co/u/mkain)
#### Post date: [July 5, 2017, 5:41am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830/3 "2017-07-05T05:41:51Z")
Hi Tim,
yes, I had added "action.auto\_create\_index:
.security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*"
after installing x-pack plugin. So is this creating the problem ?
Regards,
-Manish
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 5, 2017, 6:37am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830/4 "2017-07-05T06:37:16Z")
Yes. Try removing that setting entirely.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2017, 6:37am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830/5 "2017-08-02T06:37:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.