Custom mappings with HOT - WARM infrastructure

I’m trying to set up a template for my (many) indices with:

 "routing": {
    "allocation": {
      "require": {
        "box_type": "hot"

Sadly after index rotation in Graylog, Graylog overwrites all of my index templates and completely ignores my box_type setting basically making me unable to create a HOT-WARM infrastructure for storing logs. How can I force graylog into creating new indices ALWAYS with box_type hot or just respecting my elasticsearch templates?

Did you read the documentation about custom mappings and how to add?

This solved my problem. Every new index created by Graylog will have a box_type set to hot.

Contents of graylog_custom_mapping:

“order”: 0,
“template”: “*”,
“settings”: {
“index”: {
“routing”: {
“allocation”: {
“require”: {
“box_type”: “hot”
“refresh_interval”: “30s”
“mappings”: {},
“aliases”: {}

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.