opensearch-project / opensearch-project/security-analytics
[FEATURE] Introduce min_docs settings for rollover logic of findings/alerting indices
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Is your feature request related to a problem?
Currently, our index management job will do rollover of finding/alert indices when one of 2 conditions are met: max_index_age or max_index_docs. Rollover would be done, even tho index has 0 docs.
What solution would you like?
Introduce min_docs settings and check it before executing rollover API.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the index management job that handles finding and alerting index rollover, then trace the rollover API call and its existing max_index_age and max_index_docs settings. Add the requested min_docs settings and verify that rollover is skipped for indexes below the threshold, including indexes with zero documents.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, databases
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100