Custom mappings with HOT - WARM infrastructure

Graylog Central (peer support)
1

Hello,
I’m trying to set up a template for my (many) indices with:

 "routing": {
    "allocation": {
      "require": {
        "box_type": "hot"
      }
    }
  }

Sadly after index rotation in Graylog, Graylog overwrites all of my index templates and completely ignores my box_type setting basically making me unable to create a HOT-WARM infrastructure for storing logs. How can I force graylog into creating new indices ALWAYS with box_type hot or just respecting my elasticsearch templates?

2

Did you read the documentation about custom mappings and how to add?

http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings

3

This solved my problem. Every new index created by Graylog will have a box_type set to hot.

Contents of graylog_custom_mapping:

{
“order”: 0,
“template”: “*”,
“settings”: {
“index”: {
“routing”: {
“allocation”: {
“require”: {
“box_type”: “hot”
}
}
},
“refresh_interval”: “30s”
}
},
“mappings”: {},
“aliases”: {}
}