Using the Graylog that allows users to declare explicit field type mappings for OpenSearch. When doing so, you can choose which index sets to apply this mapping to.
In this example, Illuminate index sets are shown as eligible for this change. However, up further inspection, after clicking "Change field type"
The index set is not rotated even though "Rotate affected indices after change" is checked
The index set in OpenSearch has not been updated to reflect this mapping
Graylog does save this mapping in the index_sets MongoDB collection:
Expected Behavior
Graylog disallows changing field types for immutable index sets
Graylog UX reflect what index sets can and cannot be changed
The backend/API endpoints return errors if changing an immutable index set is attempted
Errors logged in graylog's server.log
Current Behavior
Graylog gives the appearance that it allows changing field types for immutable index sets
Graylog UX does not stop a user from attempting to change field types for immutable index sets
Graylog backend/API endpoints do not return any errors for the above
Graylog does not log any errors for the above
Steps to Reproduce (for bugs)
The following assumes you have at least 1 illuminate processing pack installed.
Go to the search page
click on the "X" in the left most menu to open the fields list
Choose any field, click on it, select Change field type
Bulk actions / Cancel selection to deselect all index sets
Select an illuminate index set
click "Change field type"
Context
Discovered this while doing research and testing for how this feature works and how it behaves.
Your Environment
Graylog Version: 6.0.3
Java Version: Bundled
OpenSearch Version: 2.15.0
MongoDB Version: 6.0.15
Operating System: Ubuntu Server 22.04 LTS
Browser version: Google Chrome Version 126.0.6478.127 (Official Build) (arm64)
Using the Graylog that allows users to declare explicit field type mappings for OpenSearch. When doing so, you can choose which index sets to apply this mapping to.
In this example, Illuminate index sets are shown as eligible for this change. However, up further inspection, after clicking "Change field type"
Graylog does save this mapping in the
index_setsMongoDB collection:Expected Behavior
server.logCurrent Behavior
Steps to Reproduce (for bugs)
The following assumes you have at least 1 illuminate processing pack installed.
Context
Discovered this while doing research and testing for how this feature works and how it behaves.
Your Environment
Please let me know if there are any questions.