Custom mappings with HOT - WARM infrastructure

(Zero) #1

I’m trying to set up a template for my (many) indices with:

 "routing": {
    "allocation": {
      "require": {
        "box_type": "hot"

Sadly after index rotation in Graylog, Graylog overwrites all of my index templates and completely ignores my box_type setting basically making me unable to create a HOT-WARM infrastructure for storing logs. How can I force graylog into creating new indices ALWAYS with box_type hot or just respecting my elasticsearch templates?

(Jan Doberstein) #2

Did you read the documentation about custom mappings and how to add?

(Zero) #3

This solved my problem. Every new index created by Graylog will have a box_type set to hot.

Contents of graylog_custom_mapping:

“order”: 0,
“template”: “*”,
“settings”: {
“index”: {
“routing”: {
“allocation”: {
“require”: {
“box_type”: “hot”
“refresh_interval”: “30s”
“mappings”: {},
“aliases”: {}

(system) closed #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.