Logstash "no such index error" when writting to Elasticsearch with X-Pack
<p>I have set a <strong>version 5 ELK stack</strong> (with X-Pack) and I use the following logstash conf file which seems to grok parse the access log correctly (as I see it in output):</p>

<pre><code>input {
  file {
    path =&gt; ["/path/to/access_log"]
    start_position =&gt; "beginning"
  }
}

filter {
    mutate { replace =&gt; { "type" =&gt; "apache_access" } }
    grok {
      match =&gt; { "message" =&gt; "%{COMBINEDAPACHELOG}" }
    }

  date {
    match =&gt; [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}

output {
  elasticsearch {
    hosts =&gt; ["127.0.0.1:9200"] 
    user =&gt; "elastic"
    password =&gt; "*****"
  }
  stdout { codec =&gt; rubydebug }
} 
</code></pre>

<p>However the elasticsearch output returns <strong>404 ("no such index") error</strong>  whatever I do except when I tried to create the index by hand using the following curl command:</p>

<pre><code>curl -XPUT 'elastic:******@localhost:9200/logstash-2016.09.28
</code></pre>

<blockquote>
  <p>[2016-11-02T17:30:09,535][WARN ][logstash.outputs.elasticsearch]
  Failed action. {:status=>404, :action=>["index", {:_id=>nil,
  :_index=>"logstash-2016.09.28", :_type=>"apache_access",
  :_routing=>nil}, 2016-09-28T11:50:32.000Z mypchost 10.2.33.155 - -
  [28/Sep/2016:14:50:32 +0300] "GET /MyApp/page HTTP/1.1" 302 -
  "<a href="http://myhttpserver/MyApp/page?22" rel="nofollow noreferrer">http://myhttpserver/MyApp/page?22</a>" "Mozilla/5.0 (Windows NT 6.1;
  WOW64; rv:35.0) Gecko/20100101 Firefox/35.0" ],
  :response=>{"index"=>{"_index"=>"logstash-2016.09.28",
  "_type"=>"apache_access", "_id"=>nil, "status"=>404,
  "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such
  index", "resource.type"=>"index_expression",
  "resource.id"=>"logstash-2016.09.28", "index_uuid"=>"<em>na</em>",
  "index"=>"logstash-2016.09.28"}}}}</p>
</blockquote>

<p>What could be the issue with not automatically creating the index?</p>

<p><strong>EDIT:</strong>
Uninstalling the X-Pack from ES and re-running the logstash did the job, i.e. created an index.
Now I need to find out what is the problem with X-Pack.</p>