# The \[action.auto\_create\_index\] setting value \[.security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*\] is too restrictive. disable \[action.auto\_create\_index\] or set it to \[.security,.security-6\] **URL:** \ **Category:** Elasticsearch\ **Created:** [January 10, 2018, 9:51am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822 "2018-01-10T09:51:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![shaonbean](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaonbean/32/14416_2.png) [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Post date:** [January 10, 2018, 9:51am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/1 "2018-01-10T09:51:27Z")
when i install elasticsearch,then install x-pack,restart elasticsearch will be errrs ```auto Caused by: java.lang.IllegalArgumentException: the [action.auto_create_index] setting value [.security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*] is too restrictive. disable [action.auto_create_index] or set it to [.security,.security-6] at org.elasticsearch.xpack.security.Security.validateAutoCreateIndex(Security.java:832) ~[?:?] at org.elasticsearch.xpack.security.Security.(Security.java:263) ~[?:?] at org.elasticsearch.xpack.XPackPlugin.(XPackPlugin.java:247) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_131] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:443) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:392) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:142) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.node.Node.(Node.java:302) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.node.Node.(Node.java:245) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:212) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:322) ~[elasticsearch-6.1.1.jar:6.1.1] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.1.1.jar:6.1.1] ... 6 more ``` ---
**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Post date:** [January 10, 2018, 11:29am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/2 "2018-01-10T11:29:04Z")
hi @shaonbean, Can you tell me which machine your ELK Stack is running ? ---
**Author:** ![shaonbean](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaonbean/32/14416_2.png) [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Post date:** [January 11, 2018, 5:09am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/3 "2018-01-11T05:09:58Z")
three vms, 0.206 0.207 0.208 , [root@aniu-saas-1 ~]# cat /etc/elasticsearch/elasticsearch.yml [cluster.name](http://cluster.name): aniu-es [node.name](http://node.name): es\_1 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch bootstrap.memory\_lock: false network.host: 0.0.0.0 #http.port: 9200 #transport.tcp.port: 9300 discovery.zen.ping.unicast.hosts: ["es\_1", "es\_2", "es\_3"] discovery.zen.minimum\_master\_nodes: 2 gateway.recover\_after\_nodes: 2 gateway.recover\_after\_time: 5m bootstrap.system\_call\_filter: false action.auto\_create\_index: .security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\* ---
**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Post date:** [January 11, 2018, 5:12am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/4 "2018-01-11T05:12:37Z")
ok type this command in last kibana.yml and elasticsearch.yml file xpack.security.enabled: true ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 11, 2018, 5:46am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/5 "2018-01-11T05:46:02Z")
> [@shaonbean](#): > > java.lang.IllegalArgumentException: the [action.auto\_create\_index] setting value [.security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*] is too restrictive. disable [action.auto\_create\_index] or set it to [.security,.security-6] This message is trying to tell you what to do. In your `config/elasticsearch.yml` you have a line that reads (roughly): ```auto action.auto_create_index: ".security,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*" ``` That's a problem because it prevents X-Pack security from creating the `.security-6` index that it needs. You can either **(1)** Change that line to be ```auto action.auto_create_index: ".security*,.monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*" ``` _or_ **(2)** Remove it entirely. ---
**Author:** ![shaonbean](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaonbean/32/14416_2.png) [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Post date:** [January 11, 2018, 8:10am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/6 "2018-01-11T08:10:44Z")
> [@TimV](#): > > action.auto\_create\_index: ".security\*,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*" thank you,it's work ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2018, 8:10am UTC](https://discuss.elastic.co/t/the-action-auto-create-index-setting-value-security-monitoring-watches-triggered-watches-watcher-history-ml-is-too-restrictive-disable-action-auto-create-index-or-set-it-to-security-security-6/114822/7 "2018-02-08T08:10:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.