Remove filter on the _index field in the org.graylog2.plugin.Message class

[nenad]

With the current setup that the org.graylog2.plugin.Message class has, it's not possible to produce output that contains the _index field. This doesn't allow us to construct a permalink to the message, which we want to push as a Slack alert.

I do not know what's the reason behind filtering out this field in the plugins package.

Expected Behavior

We should be allowed to use the _index value that a message has in the plugin package.

Current Behavior

It's not possible to get the _index field from the Message object, because it's filtered out.

References: https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L101 https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L357

Possible Solution

Put the _index key in the RESERVED_SETTABLE_FIELDS const.

Steps to Reproduce (for bugs)

1. Install https://github.com/graylog-labs/graylog-plugin-slack
2. Setup an alert to use Slack as alerting medium
3. Loop through the messages in the alert, and output them ${foreach backlog message} ${message} ${end}
4. Observe there is no index or _index field that you can use to construct the URL.

Context

Building a permalink to a message that pops up in Slack alert, so we can easily click on it and see the full message in Graylog. Currently we rely on graylog_deflector in the URL to point us to the message, but this doesn't work once the deflector changes index.

Your Environment

• Graylog Version: 2.6
• Elasticsearch Version:
• MongoDB Version: 3.0
• Operating System: Arch Linux
• Browser version: Firefox 58

[dennisoelkers]

Refs #4380

[nickcaballero]

+1