Graylog2 / Graylog2/graylog2-server
User cannot change Shards for some indices (e.g. System, Illuminate)
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Graylog users (anyone using graylog, even admins) are disallowed from modifying the Index Set settings for specific Index Sets.
Attempting to save index set settings for the affected index sets yields the following error:
HTTP 400
```json
{
"type": "ApiError",
"message": "Custom field mappings cannot be set for events and failures index sets"
}
```
See https://github.com/Graylog2/graylog2-server/blob/6864f1d6c55e150f856aeb50f977b1e2ec8fb8b4/graylog2-server/src/main/java/org/graylog2/indexer/IndexSetValidator.java#L139
Appears to apply to the following types of Index Template Types:
https://github.com/Graylog2/graylog2-server/blob/6864f1d6c55e150f856aeb50f977b1e2ec8fb8b4/graylog2-server/src/main/java/org/graylog2/indexer/indexset/IndexSetConfig.java#L67
* EVENT_TEMPLATE_TYPE
* FAILURE_TEMPLATE_TYPE
* ILLUMINATE_INDEX_TEMPLATE_TYPE
It is crucial the user be able to modify at least the shard settings in order to specify the correct number of primary shards and replica shards. Not having the ability to do so can make the OpenSearch cluster brittle and unreliable, causing a Red cluster health and cause stability problems for Graylog, such as the inability to ingest new messages or search existing messages.
## Expected Behavior
Users are able to modify crucial shard settings for ALL index sets
## Current Behavior
Users are unable to modify the above mentioned index sets
## Possible Solution
Allow modification of "Details" section for ALL index sets (Index Shards, Index Replicas, Maximum Number of Segments)
## Steps to Reproduce (for bugs)
Via Graylog Web Interface
1. Navigate to System / **Indices**
2. Click **Edit** for one of the affected Index Set types (e.g. `Graylog Events`)
3. Scroll down to bottom of page
4. Click **Update index set**
## Context
I suffered a fatal error with my 2 node OpenSearch cluster. To avoid future issues I am reconfiguring all index sets to have at least 1 replica shard so that if an OpenSearch node is offline or a shard has a catastrophic write failure, the OpenSearch cluster won't go into a Red Health state preventing log ingestion.
## Your Environment
* Graylog Version: 6.1.4
* Java Version: Bundled
* OpenSearch Version: 2.15.0
* MongoDB Version: 7.0.14
* Operating System: Ubuntu 22.04 LTS
* Browser version: Google Chrome Version 131.0.6778.140 (Official Build) (arm64)
Please let me know if there are any questions.
Contributor guide
Assessment
This issue has not been assessed yet.