Graylog2 / Graylog2/graylog2-server

Next number generated when rotating an active write index done so in unsuitable way.

Open
#11,378 6 comments 0 reactions 0 assignees View on GitHub
bug to-verify triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Current Behavior

When rotating an active write index, the next number is computed from scanning the existing indices in the set, finding the highest number used, and incrementing it by one. See the code here: https://github.com/Graylog2/graylog2-server/blob/58eaedd517dd5e20d07af4f841326f3aa0e80f98/graylog2-server/src/main/java/org/graylog2/indexer/MongoIndexSet.java#L149-L171 So, Graylog does not maintain a counter, but rather it computes the next index number on demand. So, as long as there is a high-index number in the set, the number will stay high.

In order for the number to be reduced, all existing active indices in the set will need to be a lower number.

This is problematic. If a user includes a high number in the name of a new index, all subsequent rotating indicies will be named with an increment of this high number, making the ordering of lists of Indicies a bit unintelligible.

## Possible Solution

- Include a counter in MongoDB used for increment counting.
- Including handling to make sure the next number is not already in use (using perhaps the existing handling). If it is in use, increase the counter by one and repeat the check.

## Steps to Reproduce (for bugs)

1. Create an index with 9998 in the name
2. Rotate an index
3. Behold your new index with 9999 in the name

## Context

A graylog user used a datestamp in an Index name, causing their next number to jump from ~30 to ~82000+

## Your Environment

* Graylog Version detected in : 4.05

- [ ] Please leave a note in HS-566267951 upon completion.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.