Hey there,
I am using graylog 5.1 with opensearch. Due to hardware constraints, we activated the opensearch compression for indexes to reduce the needed storage capacity - this is done by setting index.codec to the graylog indexes: Index settings - OpenSearch documentation
This already reduced the necessary storage space by a huge portion, but I did not find a way to activate it for new indexes (after graylog rotates an index) automatically. I did not find any settings in the default settings nor in the server.conf.
I did however find this setting: elasticsearch_template_name. I could not find much more information, but from what I get from the opensearch index template documentation, this can be used to set default settings for newly created indexes. However, on my installation, I can only find ‘sso_metrics--’ and ‘sso_traces--’, both of which seem to be standard indexes from opensearch for opentelemetry. The default (‘graylog-internal’) does not exist on my installation.
Could a template be used to set up compression by default? Can it just be a copy (settings-wise) of a graylog index?
Best,
Lars