PUT index working despite action.auto_create_index=false?

Elastic Stack Elasticsearch
1

Hello all,

I got a question regarding the "action.auto_create_index" setting.
I have started with documentation in the reference https://www.elastic.co/guide/en/elasticsearch/reference/7.1/docs-index_.html
Reading this, I would expect to be able to disable all index creation.

But after setting an exclusion pattern (whitelist or blacklist) or even completely forbid the creation, I'm still able to create an empty index with a simple PUT to the REST API.

Is that intended behavior or did I read the documentation wrong?

How to reproduce:

PUT _cluster/settings
{
    "persistent": {
        "action.auto_create_index": "false" 
    }
}

PUT new_index_name

This was tested on the latest elasticsearch download: stable 7.1.1 windows
But we have seen this also in earlier versions and also when setting the value via yaml config.

P.S. The good news, when I try to do a PUT with a document, that seems to be properly forbidden.

2

This is the expected behaviour. action.auto_create_index is there to prevent Elasticsearch from automatically creating indices when asked to index documents into an index that doesn't currently exist. However PUT new_index_name is an explicit index creation, not an automatic one, so action.auto_create_index has no effect.

3

Hello David,

thank you for the super fast response and clarification.
So I did misunderstand the documentation.
(May be this can be added to the documentation?)

Is there a way to achieve this (white-list/black-list of allowed indices) even for explicit PUT commands? We are looking into this due to accidental PUTs of buggy scripts.

best regards,
Heiko

4

The docs you linked are specifically about indexing operations, i.e. operations on documents, and not about explicit index creation operations, so I think they make sense. But of course I'm used to them. If there's something you can think of that would have helped then please open a PR.

I think the best bet for preventing certain actions is to use Security, although I'm not the best person to ask about the details.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.