Graylog2 / Graylog2/graylog2-server

Make Elastic indices "refresh_interval" setting configurable - or at least with a sensible default

Open
#7,800 7 comments 0 reactions 0 assignees View on GitHub
feature performance triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The index-specific setting `refresh_interval` is configurable in the index set configuration interface, via a setting called Field type refresh interval`; however, this doesn't get applied to the actual index. Instead, a default value of 1s is applied. This has a **very** high performance impact on loaded clusters.

## Expected Behavior

Changing the value of this parameter in the web interface should do something. The default value should be more sensible (for example 5 or 30s).

## Current Behavior

Changing the value of `Field type refresh interval` in the Graylog web UI does nothing.

## Possible Solution

Do something with the value of the parameter in the web UI. Otherwise, change the default value. I am not very familiar with Graylog's code, but I *believe* the problem comes from [this line](https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/indexer/EventsIndexMapping.java#L50).

## Steps to Reproduce (for bugs)
1. Create an index set (let's call it `test`) in the Graylog Web UI, with a `Field type refresh interval` value of 30s.
2. Check the index setting in Elastic - `curl /test_0/_settings/index.refresh_interval`
3. This should return nothing, i.e. the default value, i.e. 1s.

## Context

This completely destroys indexing performance of loaded clusters.

## Your Environment

* Graylog Version: any 3+ version (tested with 3.0 and 3.1)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.