Handle InvalidIndexNameException _xpack since ES 7.x

General Feedback
1

Hi guys,

Some of you have some trouble with metricbeat, logstash, filebeat, … etc.
Just one example:

Unexpected exception [_xpack] InvalidIndexNameException[Invalid index name [_xpack], must not start with '_'.]

Since ES 7.0 they added automatic ‘Index Lifecycle Management’-detection. They check the _xpack index for licensing which doesn’t exist.
To solve this you have to add a line in your configs.
For Logstash in your ‘…/conf.d/yourlog.conf’ you have to add ilm_enabled => false in your elasticsearch output option.
For all the others e.g. metricbeat you have to add setup.ilm.enabled: false to your [beatname].yml config file. Google will help if it doesn’t fit perfectly for your beat instance. ‘Filebeat ilm’ or something.
Default is setup.ilm.enabled: auto

Have a nice day!

2

Hi,

stumbled over this as well → Logstash-oss with non-removable x-pack - #2 by nean
I also addressed x_pack issues in OSS packages on the elastic’s logstash github → logstash-oss not starting and contain non-removable x-pack · Issue #10783 · elastic/logstash · GitHub

I had a look at the elastic docs and it appears ilm - “index lifecycle management API” is exclusively for x_pack, an elastic proprietary feature which shouldn’t actually cause issues in OSS versions.

1 Like
3

Ah my mistake, thank you for your reference :+1: