# Suite à installation x-pack - problème création des index journalier logstash dans elasticsearch

**URL:** <https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608>\
**Category:** Discussions en français\
**Created:** [March 7, 2017, 8:10am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608 "2017-03-07T08:10:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![rouxp](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rouxp](https://discuss.elastic.co/u/rouxp)\
**Post date:** [March 7, 2017, 8:10am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/1 "2017-03-07T08:10:11Z")

</div>

Bonjour,

J'ai mis à jour mon environnement en installant la partie x-pack. Suite à cela tout à fonctionné correctement la première journée.  
Après la première journée j'ai trouvé des log d'erreur "status 404" dans mes log logstash. Logstash ne trouve pas d'index de type "logstash-2017-03-07" dans elasticsearch et ne peut donc pas alimenter elasticsearch.  
Lorsque je crée manuellement l'index, tout va bien mais le lendemain, le problème se reproduit....

Pouvez vous m'aider?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 7, 2017, 3:10pm UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/2 "2017-03-07T15:10:51Z")

</div>

Peut-être que l'utilisateur que tu utilises pour logstash n'a pas les droits suffisants ?

Peux-tu partager tes logs pour qu'on comprenne ce qui se passe ?

A lire si tu ne l'as pas fait: [https://www.elastic.co/guide/en/x-pack/current/logstash.html](https://www.elastic.co/guide/en/x-pack/current/logstash.html)

---

<div class="post-metadata">

**Author:** ![rouxp](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rouxp](https://discuss.elastic.co/u/rouxp)\
**Post date:** [March 20, 2017, 11:04am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/3 "2017-03-20T11:04:55Z")

</div>

> [@dadoonet](#):
>
> tes logs pour qu'on comprenne ce qui se passe ?

Salut!

Merci pour ton retour.

Normalement si il devrait avoir ce qu'il faut comme droits.. C'est ca que je comprend pas justement...  
Au niveau de ma ligne de log j'ai ca :

[2017-03-07T01:05:11,839][WARN][logstash.outputs.elasticsearch] Failed action. {:status=\>404, :action=\>["index", {:\_id=\>nil, :\_index=\>"logstash-2017.03.07", :\_type=\>"nginx\_access", :_routing=\>nil}, 2017-03-07T00:05:11.000Z src-rpnginx.sysinfo.local 37.71.20.172 - calasys [07/Mar/2017:01:05:11 +0100] "GET /api/alarmcount_=1488805842984 HTTP/1.1" 200 54 "[https://toto.tutu.fr/Par/st](https://toto.tutu.fr/Par/st)" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0"], :response=\>{"index"=\>{"\_index"=\>"logstash-2017.03.07", "\_type"=\>"nginx\_access", "\_id"=\>nil, "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception", "reason"=\>"no such index", "resource.type"=\>"index\_expression", "resource.id"=\>"logstash-2017.03.07", "index\_uuid"=\>"_na_", "index"=\>"logstash-2017.03.07"}}}}

Concernant la doc, c'est bien celle que j'ai lu! 🙂

J'ai fais correctement la partie 1,2 (logstash\_writer et logstash\_internal). Pour la partie 3, l'authentification n'est que pour l'output.

L'ajout d'information quand l'index est présent est OK par contre...

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2017, 2:22pm UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/4 "2017-03-20T14:22:01Z")

</div>

Tu peux montrer tes logs elasticsearch?

Please format your code using `</>` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will make your post more readable.

Or use markdown style like:

````
```
CODE
```
````

---

<div class="post-metadata">

**Author:** ![rouxp](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rouxp](https://discuss.elastic.co/u/rouxp)\
**Post date:** [March 21, 2017, 3:19pm UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/5 "2017-03-21T15:19:44Z")

</div>

Je viens à l'instant de créer "manuellement" mon index. Voici mes logs de la journée pour elasticsearch :

\</\>  
[2017-03-21T01:00:02,054][INFO][o.e.x.m.e.l.LocalExporter] cleaning up [1] old indices  
[2017-03-21T01:00:02,061][INFO][o.e.c.m.MetaDataDeleteIndexService] [aAnCiIR] [.monitoring-es-2-2017.03.13/k7Xj6AwwTKKHbA2sqd3EKw] deleting index  
[2017-03-21T01:00:02,711][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-kibana-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-kibana-2], shards [1]/[1], mappings [_default_, kibana\_stats]  
[2017-03-21T01:00:08,249][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-logstash-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-logstash-2], shards [1]/[1], mappings [_default_, logstash\_stats]  
[2017-03-21T01:00:10,941][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-es-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-es-2], shards [1]/[1], mappings [_default_, shards, node, index\_stats, index\_recovery, cluster\_state, cluster\_stats, indices\_stats, node\_stats]  
[2017-03-21T01:00:11,271][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci\_Q] update\_mapping [node\_stats]  
[2017-03-21T01:00:11,295][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci\_Q] update\_mapping [index\_stats]  
[2017-03-21T01:00:11,453][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci\_Q] update\_mapping [indices\_stats]  
[2017-03-21T01:00:11,475][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci\_Q] update\_mapping [cluster\_stats]  
[2017-03-21T11:39:08,557][WARN][o.e.l.LicenseService] [aAnCiIR]

# 

# License [will expire] on [Sunday, April 02, 2017]. If you have a new license, please update it.

# Otherwise, please reach out to your support contact.

# 

# Commercial plugins operate with reduced functionality on license expiration:

# - security

# - Cluster health, cluster stats and indices stats operations are blocked

# - All data operations (read and write) continue to work

# - watcher

# - PUT / GET watch APIs are disabled, DELETE watch API continues to work

# - Watches execute and write to the history

# - The actions of the watches don't execute

# - monitoring

# - The agent will stop collecting cluster and indices metrics

# - The agent will stop automatically cleaning indices older than [xpack.monitoring.history.duration]

# - graph

# - Graph explore APIs are disabled

[2017-03-21T16:15:37,186][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-kibana-2-2017.03.21/Btcssw1sTQOQ6oMa\_Jb0Vg] update\_mapping [kibana\_stats]  
[2017-03-21T16:15:57,942][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.21] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]  
[2017-03-21T16:15:58,659][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK\_d74Yg] create\_mapping [nginx\_access]  
[2017-03-21T16:16:01,489][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.22] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]  
[2017-03-21T16:16:20,887][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK\_d74Yg] update\_mapping [nginx\_access]  
\</\>

Ils ne me semblent pas très bavard au final....

---

<div class="post-metadata">

**Author:** ![rouxp](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rouxp](https://discuss.elastic.co/u/rouxp)\
**Post date:** [March 21, 2017, 3:21pm UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/6 "2017-03-21T15:21:01Z")

</div>

> [@dadoonet](#):
>
> ```auto
> [2017-03-21T01:00:02,054][INFO][o.e.x.m.e.l.LocalExporter] cleaning up [1] old indices
> [2017-03-21T01:00:02,061][INFO][o.e.c.m.MetaDataDeleteIndexService] [aAnCiIR] [.monitoring-es-2-2017.03.13/k7Xj6AwwTKKHbA2sqd3EKw] deleting index
> [2017-03-21T01:00:02,711][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-kibana-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-kibana-2], shards [1]/[1], mappings [_default_, kibana_stats]
> [2017-03-21T01:00:08,249][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-logstash-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-logstash-2], shards [1]/[1], mappings [_default_, logstash_stats]
> [2017-03-21T01:00:10,941][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [.monitoring-es-2-2017.03.21] creating index, cause [auto(bulk api)], templates [.monitoring-es-2], shards [1]/[1], mappings [_default_, shards, node, index_stats, index_recovery, cluster_state, cluster_stats, indices_stats, node_stats]
> [2017-03-21T01:00:11,271][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci_Q] update_mapping [node_stats]
> [2017-03-21T01:00:11,295][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci_Q] update_mapping [index_stats]
> [2017-03-21T01:00:11,453][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci_Q] update_mapping [indices_stats]
> [2017-03-21T01:00:11,475][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-es-2-2017.03.21/1ymHJqpFTEWAyR3MZNci_Q] update_mapping [cluster_stats]
> [2017-03-21T11:39:08,557][WARN][o.e.l.LicenseService] [aAnCiIR]
> #
> # License [will expire] on [Sunday, April 02, 2017]. If you have a new license, please update it.
> # Otherwise, please reach out to your support contact.
> #
> # Commercial plugins operate with reduced functionality on license expiration:
> # - security
> # - Cluster health, cluster stats and indices stats operations are blocked
> # - All data operations (read and write) continue to work
> # - watcher
> # - PUT / GET watch APIs are disabled, DELETE watch API continues to work
> # - Watches execute and write to the history
> # - The actions of the watches don't execute
> # - monitoring
> # - The agent will stop collecting cluster and indices metrics
> # - The agent will stop automatically cleaning indices older than [xpack.monitoring.history.duration]
> # - graph
> # - Graph explore APIs are disabled
> [2017-03-21T16:15:37,186][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [.monitoring-kibana-2-2017.03.21/Btcssw1sTQOQ6oMa_Jb0Vg] update_mapping [kibana_stats]
> [2017-03-21T16:15:57,942][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.21] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]
> [2017-03-21T16:15:58,659][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK_d74Yg] create_mapping [nginx_access]
> [2017-03-21T16:16:01,489][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.22] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]
> [2017-03-21T16:16:20,887][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK_d74Yg] update_mapping [nginx_access]
> 
> ```

avec la mise en forme...

---

<div class="post-metadata">

**Author:** ![rouxp](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rouxp](https://discuss.elastic.co/u/rouxp)\
**Post date:** [March 27, 2017, 10:09am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/7 "2017-03-27T10:09:53Z")

</div>

Bonjour,

Petit up sur le sujet! Je continue de chercher de mon coté mais à ce jour pas d'explication. La partie licencing ne parait pas être la raison!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 3, 2017, 8:32am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/8 "2017-04-03T08:32:18Z")

</div>

Aucun rapport avec la partie xpack en effet.

Peux-tu donner les logs au moment où tu reçois une erreur 404 (en début de journée en fait) ?

Est-ce que tu vois des lignes équivalentes à:

```auto
[2017-03-21T16:15:57,942][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.21] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]
[2017-03-21T16:15:58,659][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK_d74Yg] create_mapping [nginx_access]
[2017-03-21T16:16:01,489][INFO][o.e.c.m.MetaDataCreateIndexService] [aAnCiIR] [logstash-2017.03.22] creating index, cause [api], templates [logstash], shards [5]/[1], mappings [_default_]
[2017-03-21T16:16:20,887][INFO][o.e.c.m.MetaDataMappingService] [aAnCiIR] [logstash-2017.03.21/2pT4c3eLSSmJnnvK_d74Yg] update_mapping [nginx_access]

```

Sans que tu crées toi même l'index.

Quelle version utilises-tu ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2017, 8:32am UTC](https://discuss.elastic.co/t/suite-a-installation-x-pack-probleme-creation-des-index-journalier-logstash-dans-elasticsearch/77608/9 "2017-05-01T08:32:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.