Graylog2 / Graylog2/graylog2-server

Allow Graylog to monitor OpenSearch indices and alerts if field count is near the limit

Open
#21,775 2 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Graylog stores messages in OpenSearch. OpenSearch, by default, has a limit of 1000 fields per index. While this can be changed it has performance implications and is not recommended.

Because graylog abstracts away OpenSearch, its not immediately clear or evident that an index is close to this limit or in danger of exceeding it.

When this limit is hit, no further messages can be indexed in the index that has reached this limit which is a critical state for a graylog cluster.

## Why?

Provide transparency to the user about the health of OpenSearch indices and help prevent reaching field limit

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.