Graylog2 / Graylog2/graylog2-server

Add the ability to create an index set through the use of a content pack

Open
#10,874 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Currently, we can't create index sets through the use of the API. As I understand content packs, they're consolidated JSON documents that enable the creation of pretty much every other type of resource within Graylog. Given that the creation of an index set can be done by making an API call, it makes sense in my mind that we would add that to the list:

![CleanShot 2021-06-16 at 21 23 56](https://user-images.githubusercontent.com/898627/122316121-4bd6c400-cee9-11eb-948e-1b492281253e.png)

## Why?

The reason to add this is that it would decrease the amount of steps needed to deploy Illuminate content to Graylog. Consider that the majority of the content needed for Illuminate to function is already done through the use of a content pack, it would make sense that I could also bundle up the creation of an index set with some "sane defaults" like:

* A time-based rotation strategy of P1D
* A time-based retention strategy of 30D
* A default of closing the indices rather than deleting or relying on archiving to be configured (though depending on how we wanted to do this, I think that much of the defaults here could be surfaced as additions to the Illuminate documentation)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.