Some of you have some trouble with metricbeat, logstash, filebeat, … etc.
Just one example:
Unexpected exception [_xpack] InvalidIndexNameException[Invalid index name [_xpack], must not start with '_'.]
Since ES 7.0 they added automatic ‘Index Lifecycle Management’-detection. They check the _xpack index for licensing which doesn’t exist.
To solve this you have to add a line in your configs.
For Logstash in your ‘…/conf.d/yourlog.conf’ you have to add
ilm_enabled => false in your elasticsearch output option.
For all the others e.g. metricbeat you have to add
setup.ilm.enabled: false to your [beatname].yml config file. Google will help if it doesn’t fit perfectly for your beat instance. ‘Filebeat ilm’ or something.
Have a nice day!