User cannot change Shards for some indices (e.g. System, Illuminate)

[drewmiranda-gl]

Graylog users (anyone using graylog, even admins) are disallowed from modifying the Index Set settings for specific Index Sets.

Attempting to save index set settings for the affected index sets yields the following error:

HTTP 400

{
    "type": "ApiError",
    "message": "Custom field mappings cannot be set for events and failures index sets"
}

See

graylog2-server/graylog2-server/src/main/java/org/graylog2/indexer/IndexSetValidator.java

Line 139 in 6864f1d

return Violation.create("Custom field mappings cannot be set for events and failures index sets");

Appears to apply to the following types of Index Template Types:

graylog2-server/graylog2-server/src/main/java/org/graylog2/indexer/indexset/IndexSetConfig.java

Line 67 in 6864f1d

private static final Set<String> TEMPLATE_TYPES_FOR_INDEX_SETS_WITH_IMMUTABLE_FIELD_TYPES = Set.of(

• EVENT_TEMPLATE_TYPE
• FAILURE_TEMPLATE_TYPE
• ILLUMINATE_INDEX_TEMPLATE_TYPE

It is crucial the user be able to modify at least the shard settings in order to specify the correct number of primary shards and replica shards. Not having the ability to do so can make the OpenSearch cluster brittle and unreliable, causing a Red cluster health and cause stability problems for Graylog, such as the inability to ingest new messages or search existing messages.

Expected Behavior

Users are able to modify crucial shard settings for ALL index sets

Current Behavior

Users are unable to modify the above mentioned index sets

Possible Solution

Allow modification of "Details" section for ALL index sets (Index Shards, Index Replicas, Maximum Number of Segments)

Steps to Reproduce (for bugs)

Via Graylog Web Interface

1. Navigate to System / Indices
2. Click Edit for one of the affected Index Set types (e.g. Graylog Events)
3. Scroll down to bottom of page
4. Click Update index set

Context

I suffered a fatal error with my 2 node OpenSearch cluster. To avoid future issues I am reconfiguring all index sets to have at least 1 replica shard so that if an OpenSearch node is offline or a shard has a catastrophic write failure, the OpenSearch cluster won't go into a Red Health state preventing log ingestion.

Your Environment

• Graylog Version: 6.1.4
• Java Version: Bundled
• OpenSearch Version: 2.15.0
• MongoDB Version: 7.0.14
• Operating System: Ubuntu 22.04 LTS
• Browser version: Google Chrome Version 131.0.6778.140 (Official Build) (arm64)

Please let me know if there are any questions.

[tellistone]

Unable to reproduce in master, I am able to change shard config of Graylog Events index