Graylog 6.0.3 index.refresh_interval

New to Graylog Community? READ-ME FIRST Guides
1

Hi,
I just did a fresh install of Graylog 6.0.3, installing everything on a single server. Now that we are moving forward, I have been requested to use AWS Opensearch instead of the opensearch install I had on EC2. That being said, everything seems to work fine, but when it gets to opensearch I get these errors:

{“error”:{“root_cause”:[{“type”:“illegal_argument_exception”,“reason”:“invalid index.refresh_interval [1s]: cannot be smaller than cluster.minimum.index.refresh_interval [10s]”}],“type”:“illegal_argument_exception”,“reason”:“invalid index.refresh_interval [1s]: cannot be smaller than cluster.minimum.index.refresh_interval [10s]”},“status”:400}

Opensearch seems to have a default of 1s, but I assume AWS is not doing the same based on that error.
Is there anywhere I can override this in graylog?

Thank you,

Geoff

2

Well, I feel a little silly now. For anyone else out there, if you are using the new OR1 instance types in AWS Opensearch, the minimum for these instance types only is 10s.

1 Like