.fleet-actions index not found

[simitt]

Running with the latest 7.13.0-SNAPSHOT (20201/04/16) the fleet-server logs an error that the .fleet-actions index cannot be found.

{"log.level":"info","index":".fleet-actions","ctx":"index monitor","@timestamp":"2021-04-16T10:15:54.05Z","message":"index not found, try again in 3s"}

How to reproduce

Start agent with docker container command, for example (change ES and Kibana configs accordingly)

docker run  \
  --env KIBANA_FLEET_SETUP=1  \
  --env FLEET_SERVER_ENABLE=1 \
  --env FLEET_ENROLL=1  \
  --env FLEET_INSECURE=1 \
  --env ELASTICSEARCH_HOST="http://elasticsearch:9200" \
  --env ELASTICSEARCH_USERNAME=admin \
  --env ELASTICSEARCH_PASSWORD=password \
  --env KIBANA_FLEET_HOST="http://kibana:5601" \
  --env KIBANA_FLEET_PASSWORD="password" \
  --env KIBANA_FLEET_USERNAME="admin"  \
  -p 8220:8220  \
  --rm docker.elastic.co/beats/elastic-agent:7.13.0-SNAPSHOT

[ruflin]

My initial thought was that maybe a backport on the Elasticsearch side is missing as this index should be created by Elasticsearch. But it is here: https://github.com/elastic/elasticsearch/blob/7.x/x-pack/plugin/core/src/main/resources/fleet-actions.json

[aleksmaus]

Do you want to change this to debug level log?

[aleksmaus]

It is WAD. The index is not created until the first action document is indexed. And so far the .fleet-actions are only used for osquerybeat as far as I know.

[simitt]

ah ok, I believe logging as debug instaed of info would make more sense then.

[aleksmaus]

sounds good. will update.