elasticsearch/docs/reference/setup/install/xpack-indices.asciidoc

By default, {es} is configured to allow automatic index creation, and no
additional steps are required. However, if you have disabled automatic index
creation in {es}, you must configure
<<index-creation,`action.auto_create_index`>> in `elasticsearch.yml` to allow
{xpack} to create the following indices:

[source,yaml]
-----------------------------------------------------------
action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*
-----------------------------------------------------------

[IMPORTANT]
=============================================================================
If you are using https://www.elastic.co/products/logstash[Logstash]
or https://www.elastic.co/products/beats[Beats] then you will most likely
require additional index names in your `action.auto_create_index` setting, and
the exact value will depend on your local configuration. If you are unsure of
the correct value for your environment, you may consider setting the value to
 `*` which will allow automatic creation of all indices.
=============================================================================