Graylog2 / Graylog2/graylog2-server

Allow multiple Field Type Profiles to be configured per index set, allow setting priority

Open
#23,003 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Allow multiple Field Type Profiles to be configured per index set, allow setting priority

## Why?

While Graylog's ability to allow users to use the UI to configure Field Mappings, it is not possible to configure more than a single field type per index set.

Consider the following:

* You DO want to explicitly map your fields
* Some indices share common fields
* Some indices have fields unique to that index
* If Index A and Index B have common fields, but Index B has additional fields, there is no way to mange, in one place, field mappings. Either ALL field mappings for both index sets are configured, OR you have separate index type profiles
* This does not scale well and gets pretty difficult to manage

A proposed solution:

* Allow more than one field type profile to be configured for an index set
* Allow the above configuration to specify a priority or order of the configured field type profiles
* What this means is that field mappings from both field type profiles apply
* If there is a conflict (meaning the same field exists in both profiles, defer to the priority or order to determine which field type should apply.)

This allows Graylog admins to combine various index type profiles and not have to duplicate any work or manage the same field types across a number of field type profiles.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.