Data Node Configuration Overrides

It is possible to add a separate configuration file including specific OpenSearch configuration properties and values that are not supported in the Data Node configuration file. This capability allows you to add additional OpenSearch-supported configurations to manage your Data Nodes.

Warning: Override configurations are not supported by Graylog and should be fully tested for individual use in a non-production environment. Some override configurations have been tested for use with Graylog and added to the system allowlist by default, as detailed in the following section. However, any additional override OpenSearch configurations applied will trigger a system warning notification and can result in unexpected behavior!

Data Node Configuration File

The following property in the Data Node configuration file must be modified to enable configuration overrides, as seen in the section below. See Data Node Configuration Settings Reference for more information on this file.

  • opensearch_configuration_overrides_file: This property defines the path to the file with configuration properties overriding default OpenSearch parameters. The required format is a Java properties file.

Create and Add Configuration Overrides

To use override configurations in your Graylog environment: 

  1. Create a Java configuration property file containing your desired parameters and their values listed in line-separated format. For example: 

    Copy 
    cluster.routing.allocation.disk.watermark.low = 80%
    plugins.security.ssl.transport.enforce_hostname_verification = false

  2. Store this file in the same directory as the Data Node configuration file, listed at /etc/graylog/datanode/datanode.conf by default. For example: 

    Copy 
    /etc/graylog/datanode/overrideconfig.conf

  3. In the Data Node configuration file, set the opensearch_configuration_overrides_file parameter to this path containing your override file:

    Copy 
    opensearch_configuration_overrides_file = /etc/graylog/datanode/overrideconfig.conf

  4. Restart the Data Node service to apply the configuration: 

    Copy 
    sudo systemctl restart graylog-datanode

Override Configuration Allowlist

The following OpenSearch configuration properties have been added to Graylog's allowlist and do will not trigger a system warning when applied to the Data Node's configuration.

Warning: These parameters have been tested for use with Graylog; however, please note that override configurations are not supported by Graylog and should be fully tested for individual use in a non-production environment. We encourage you to review the provided OpenSearch reference documentation for each of the following parameters to determine intended behavior and configuration guidelines.

Parameter Description OpenSearch Reference
cluster.routing.allocation.disk.watermark.* Watermark settings Cluster-level routing and allocation settings
cluster.routing.allocation.awareness.* Shard allocation awareness Cluster-level routing and allocation settings
node.attr.zone Shard allocation awareness Shard allocation awareness settings
plugins.security.ssl.transport.enforce_hostname_verification Hostname verification

Generate an admin certificate

Hostname verification and DNS lookup

index.codec Index field compression Index codecs

Further Reading

Explore the following additional resources and recommended readings to expand your knowledge on related topics: