Graylog and OpenSearch Index Templates

Documentation Campfire
1

Does Graylog use OpenSearch Index Templates? I’m not seeing any.

I need to set up an OpenSearch index template pattern to apply a setting to all new indices that are created in one of our index sets… can I do this without affecting the normal settings that Graylog specifies when the index set is rotated and it creates the next index for writing? I’m not sure exactly how Graylog creates new indices.

What happens with I create a field type mapping or apply a field type profile - does Graylog put these in an OpenSearch index template, or just incorporate the field type settings when it creates each new index directly?

Thanks,

– Ed

2

I found what looks to be the OpenSearch legacy templates maintained by Graylog for our index sets in http://localhost:9200/_template. There is one for each index set named “index_set_prefix-template”.

Can we alter these and not have Graylog overwrite them and remove the extra settings I put in?

Thanks,

– Ed