Graylog2 / Graylog2/graylog2-server

User cannot change Shards for some indices (e.g. System, Illuminate)

Open
#21,254 6 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Graylog users (anyone using graylog, even admins) are disallowed from modifying the Index Set settings for specific Index Sets.

Attempting to save index set settings for the affected index sets yields the following error:

HTTP 400

```json
{
"type": "ApiError",
"message": "Custom field mappings cannot be set for events and failures index sets"
}
```

See https://github.com/Graylog2/graylog2-server/blob/6864f1d6c55e150f856aeb50f977b1e2ec8fb8b4/graylog2-server/src/main/java/org/graylog2/indexer/IndexSetValidator.java#L139

Appears to apply to the following types of Index Template Types:
https://github.com/Graylog2/graylog2-server/blob/6864f1d6c55e150f856aeb50f977b1e2ec8fb8b4/graylog2-server/src/main/java/org/graylog2/indexer/indexset/IndexSetConfig.java#L67

* EVENT_TEMPLATE_TYPE
* FAILURE_TEMPLATE_TYPE
* ILLUMINATE_INDEX_TEMPLATE_TYPE

It is crucial the user be able to modify at least the shard settings in order to specify the correct number of primary shards and replica shards. Not having the ability to do so can make the OpenSearch cluster brittle and unreliable, causing a Red cluster health and cause stability problems for Graylog, such as the inability to ingest new messages or search existing messages.

## Expected Behavior

Users are able to modify crucial shard settings for ALL index sets

## Current Behavior

Users are unable to modify the above mentioned index sets

## Possible Solution

Allow modification of "Details" section for ALL index sets (Index Shards, Index Replicas, Maximum Number of Segments)

## Steps to Reproduce (for bugs)

Via Graylog Web Interface

1. Navigate to System / **Indices**
2. Click **Edit** for one of the affected Index Set types (e.g. `Graylog Events`)
3. Scroll down to bottom of page
4. Click **Update index set**

## Context

I suffered a fatal error with my 2 node OpenSearch cluster. To avoid future issues I am reconfiguring all index sets to have at least 1 replica shard so that if an OpenSearch node is offline or a shard has a catastrophic write failure, the OpenSearch cluster won't go into a Red Health state preventing log ingestion.

## Your Environment

* Graylog Version: 6.1.4
* Java Version: Bundled
* OpenSearch Version: 2.15.0
* MongoDB Version: 7.0.14
* Operating System: Ubuntu 22.04 LTS
* Browser version: Google Chrome Version 131.0.6778.140 (Official Build) (arm64)

Please let me know if there are any questions.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.