The [action.auto_create_index] setting value [.security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*] is too restrictive. disable [action.auto_create_index] or set it to [.security,.security-6]

Elastic Stack Elasticsearch
1

when i install elasticsearch,then install x-pack,restart elasticsearch will be errrs

Caused by: java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [.security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*] is too restrictive. disable [action.auto_create_index] or set it to [.security,.security-6]
        at org.elasticsearch.xpack.security.Security.validateAutoCreateIndex(Security.java:832) ~[?:?]
        at org.elasticsearch.xpack.security.Security.<init>(Security.java:263) ~[?:?]
        at org.elasticsearch.xpack.XPackPlugin.<init>(XPackPlugin.java:247) ~[?:?]
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_131]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:443) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:392) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:142) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.node.Node.<init>(Node.java:302) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.node.Node.<init>(Node.java:245) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:212) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:322) ~[elasticsearch-6.1.1.jar:6.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.1.1.jar:6.1.1]
        ... 6 more
2

hi @shaonbean,

Can you tell me which machine your ELK Stack is running ?

3

three vms, 0.206 0.207 0.208 ,
[root@aniu-saas-1 ~]# cat /etc/elasticsearch/elasticsearch.yml
cluster.name: aniu-es
node.name: es_1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: false
network.host: 0.0.0.0
#http.port: 9200
#transport.tcp.port: 9300
discovery.zen.ping.unicast.hosts: ["es_1", "es_2", "es_3"]
discovery.zen.minimum_master_nodes: 2
gateway.recover_after_nodes: 2
gateway.recover_after_time: 5m
bootstrap.system_call_filter: false
action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*

4

ok type this command in last kibana.yml and elasticsearch.yml file

xpack.security.enabled: true

5

This message is trying to tell you what to do.

In your config/elasticsearch.yml you have a line that reads (roughly):

action.auto_create_index: ".security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*"

That's a problem because it prevents X-Pack security from creating the .security-6 index that it needs.
You can either

(1) Change that line to be

action.auto_create_index: ".security*,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*"

or
(2) Remove it entirely.

2 Likes
6

thank you,it's work

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.