title: Logstash "no such index error" when writting to Elasticsearch with X-Pack
body: <p>I have set a <strong>version 5 ELK stack</strong> (with X-Pack) and I use the following logstash conf file which seems to grok parse the access log correctly (as I see it in output):</p>
  
  <pre><code>input {
    file {
      path =&gt; ["/path/to/access_log"]
      start_position =&gt; "beginning"
    }
  }
  
  filter {
      mutate { replace =&gt; { "type" =&gt; "apache_access" } }
      grok {
        match =&gt; { "message" =&gt; "%{COMBINEDAPACHELOG}" }
      }
  
    date {
      match =&gt; [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["127.0.0.1:9200"] 
      user =&gt; "elastic"
      password =&gt; "*****"
    }
    stdout { codec =&gt; rubydebug }
  } 
  </code></pre>
  
  <p>However the elasticsearch output returns <strong>404 ("no such index") error</strong>  whatever I do except when I tried to create the index by hand using the following curl command:</p>
  
  <pre><code>curl -XPUT 'elastic:******@localhost:9200/logstash-2016.09.28
  </code></pre>
  
  <blockquote>
    <p>[2016-11-02T17:30:09,535][WARN ][logstash.outputs.elasticsearch]
    Failed action. {:status=>404, :action=>["index", {:_id=>nil,
    :_index=>"logstash-2016.09.28", :_type=>"apache_access",
    :_routing=>nil}, 2016-09-28T11:50:32.000Z mypchost 10.2.33.155 - -
    [28/Sep/2016:14:50:32 +0300] "GET /MyApp/page HTTP/1.1" 302 -
    "<a href="http://myhttpserver/MyApp/page?22" rel="nofollow noreferrer">http://myhttpserver/MyApp/page?22</a>" "Mozilla/5.0 (Windows NT 6.1;
    WOW64; rv:35.0) Gecko/20100101 Firefox/35.0" ],
    :response=>{"index"=>{"_index"=>"logstash-2016.09.28",
    "_type"=>"apache_access", "_id"=>nil, "status"=>404,
    "error"=>{"type"=>"index_not_found_exception", "reason"=>"no such
    index", "resource.type"=>"index_expression",
    "resource.id"=>"logstash-2016.09.28", "index_uuid"=>"<em>na</em>",
    "index"=>"logstash-2016.09.28"}}}}</p>
  </blockquote>
  
  <p>What could be the issue with not automatically creating the index?</p>
  
  <p><strong>EDIT:</strong>
  Uninstalling the X-Pack from ES and re-running the logstash did the job, i.e. created an index.
  Now I need to find out what is the problem with X-Pack.</p>