# Graylog-datanode opensearch.yml

**URL:** <https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394>\
**Category:** Graylog Central (peer support)\
**Created:** [December 6, 2024, 10:53pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394 "2024-12-06T22:53:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcury](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@mcury](https://community.graylog.org/u/mcury)\
**Post date:** [December 6, 2024, 10:53pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/1 "2024-12-06T22:53:40Z")

</div>

I’m trying to snapshot _graylog-datanode_ for backup purposes.  
Unfortunately, all changes I make to opensearch.yml are erased once the service is started.

**OS Information** : Raspberry Pi 5 8GB | Graylog 6.1.4+7528370

**Error when trying to create a snapshot** :  
`{"error":{"root_cause":[{"type":"repository_exception","reason":"[snapshot] location [/opensearch_backup] doesn't match any of the locations specified by path.repo because this setting is empty"}],"type":"repository_exception","reason":"[snapshot] failed to create repository","caused_by":{"type":"repository_exception","reason":"[snapshot] location [/opensearch_backup] doesn't match any of the locations specified by path.repo because this setting is empty"}},"status":500`

Searched the GUI, search Graylog server.conf file, search datanode.conf file, there isn’t an option that overrides this behavior.

Is there a way to accomplish this ?  
I mean, with Elasticsearch and Opensearch, I was able to do this pretty easily.  
But now, with graylog-datanode, is that even possible ?

Thanks.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 7, 2024, 4:39am UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/2 "2024-12-07T04:39:26Z")

</div>

Hey @mcury

Im not sure all what you configured but here is my 2 cents.

Repo:  
Create a directory called:

```auto
/mnt/opensearch_backup

```

In the Opensearch YAML file add configuration.

```auto
path.repo /mnt/opensearch_backup

```

restart Opensearch service to take affect,.

```auto
systemctl restart opensearch

```

The execute curl command:

```auto
PUT /opensearch_backup
{
  "type": "fs",
  "settings": {
    "location": "/mnt/opensearch-backup"
  }
}

```

see if that will work.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 7, 2024, 4:40am UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/3 "2024-12-07T04:40:46Z")

</div>

> [@mcury](#):
>
> But now, with graylog-datanode, is that even possible ?

I’m not sure, I don’t work with Graylog Datanode, it might have a issue.

---

<div class="post-metadata">

**Author:** ![mcury](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@mcury](https://community.graylog.org/u/mcury)\
**Post date:** [December 7, 2024, 10:42am UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/4 "2024-12-07T10:42:44Z")

</div>

> [@gsmith](#):
>
> I’m not sure, I don’t work with Graylog Datanode, it might have a issue.

Yeap, found out that you can’t do that with graylog-datanode, unfortunately.

I think that, not long from now, they are going to drop support for standalone opensearch and force users to migrate to graylog-datanode.

I’m saying this due to their business model.  
“Archiving” is a paid feature.

What bothers me is that nothing was mentioned about this, they advertised this as an easier and more compatible approach to Graylog than opensearch manual installation…

Hope I’m wrong about this.

---

<div class="post-metadata">

**Author:** ![matthias\_gl](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@matthias\_gl](https://community.graylog.org/u/matthias_gl)\
**Post date:** [December 12, 2024, 4:22pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/5 "2024-12-12T16:22:10Z")

</div>

Hi @mcury ,  
with data node, the `opensearch.yml` is auto-generated by data node on startup.

If you want to set `path_repo`, please include it in `datanode.conf`.

Hope this helps,  
Matthias

---

<div class="post-metadata">

**Author:** ![mcury](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@mcury](https://community.graylog.org/u/mcury)\
**Post date:** [December 12, 2024, 9:43pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/6 "2024-12-12T21:43:20Z")

</div>

Really thanks Matthias, it is working perfectly with your suggestion.  
That **path\_repo** in **datanode.conf** did the trick.

**Edit.**

After digging for a while, found the possible options to configure _datanode.conf_ @ [https://go2docs.graylog.org/current/setting\_up\_graylog/data\_node\_configuration\_file.htm](https://go2docs.graylog.org/current/setting_up_graylog/data_node_configuration_file.htm)

It seems that it is not possible to include **plugins.security.authcz.admin\_dn:** values in _graylog-datanode.conf_ file.

This is causing **OpenSearch Security not initialized.** error while trying **CURL -XDELETE**.  
**securityadmin.sh** also fails to launch because of that, it tries to use user “null”.

Anything I could have missed ?  
Or, if it is not supported, do you know if this will be possible in a future version ?

Thanks

---

<div class="post-metadata">

**Author:** ![matthias\_gl](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@matthias\_gl](https://community.graylog.org/u/matthias_gl)\
**Post date:** [December 13, 2024, 3:10pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/7 "2024-12-13T15:10:59Z")

</div>

Right now, we pass through opensearch properties from environment variables prefixed with `opensearch.` to OpenSearch. In your case, this would be `opensearch.plugins.security.authcz.admin_dn`.  
This is not documented as it may be subject to change in following versions and replaced by another mechanism. Please be aware of this if you intend to use it.

---

<div class="post-metadata">

**Author:** ![mcury](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@mcury](https://community.graylog.org/u/mcury)\
**Post date:** [December 13, 2024, 3:26pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/8 "2024-12-13T15:26:43Z")

</div>

Thanks once again Matthias, you have been extremely helpful.  
I’ll keep watching for the release notes before updating.

As a note, I’m not sure if graylog-datanode is the best option for me.  
I’m thinking in about going back to opensearch manual installation since there is more documentation about it all over the internet.

Anyway, really thanks for all your time and efforts in helping me, much appreciated 👍 👍

**Edit:** I tried to include that option `opensearch.plugins.security.authcz.admin_dn` in datanode.conf, but no joy.  
`opensearch.yml` keeps not showing that setting when `graylog-datanode.service` starts.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 27, 2024, 3:27pm UTC](https://community.graylog.org/t/graylog-datanode-opensearch-yml/34394/9 "2024-12-27T15:27:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
