Graylog2 / Graylog2/graylog2-server
Add the ability to create an index set through the use of a content pack
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
Currently, we can't create index sets through the use of the API. As I understand content packs, they're consolidated JSON documents that enable the creation of pretty much every other type of resource within Graylog. Given that the creation of an index set can be done by making an API call, it makes sense in my mind that we would add that to the list:

## Why?
The reason to add this is that it would decrease the amount of steps needed to deploy Illuminate content to Graylog. Consider that the majority of the content needed for Illuminate to function is already done through the use of a content pack, it would make sense that I could also bundle up the creation of an index set with some "sane defaults" like:
* A time-based rotation strategy of P1D
* A time-based retention strategy of 30D
* A default of closing the indices rather than deleting or relying on archiving to be configured (though depending on how we wanted to do this, I think that much of the defaults here could be surfaced as additions to the Illuminate documentation)
Contributor guide
Assessment
This issue has not been assessed yet.