Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch-2.5.0-1.x86_64
Describe the issue:
After the update to 2.5.0, winlogbeat index templates are not getting applied to new indexes.
Configuration:
I have an index template:
{
"winlogbeat-7.12.1" : {
"order" : 1,
"index_patterns" : [
"winlogbeat-7.12.1-*"
],
"settings" : {
"index" : {
"codec" : "best_compression",
"mapping" : {
"total_fields" : {
"limit" : "10000"
}
},
"refresh_interval" : "5s",
"number_of_shards" : "1",
"max_docvalue_fields_search" : "200",
"query" : {
"default_field" : [
"message",
"tags",
"agent.ephemeral_id",
...
That seems to no longer be applied.
Relevant Logs or Screenshots:
New index settings:
# curl -X GET "https://XXX:9200/winlogbeat-7.12.1-2023.01.25/_settings?pretty"
{
"winlogbeat-7.12.1-2023.01.25" : {
"settings" : {
"index" : {
"creation_date" : "1674604801637",
"number_of_shards" : "1",
"number_of_replicas" : "1",
"uuid" : "sXqVcTjUTqWfiugG-4uBoA",
"version" : {
"created" : "136267827"
},
"provided_name" : "winlogbeat-7.12.1-2023.01.25"
}
}
}
}
Previous index setting:
# curl -X GET "https://XXX:9200/winlogbeat-7.12.1-2023.01.24/_settings?pretty"
{
"winlogbeat-7.12.1-2023.01.24" : {
"settings" : {
"index" : {
"codec" : "best_compression",
"mapping" : {
"total_fields" : {
"limit" : "10000"
}
},
"refresh_interval" : "5s",
"number_of_shards" : "1",
"provided_name" : "winlogbeat-7.12.1-2023.01.24",
"max_docvalue_fields_search" : "200",
"query" : {
"default_field" : [
"message",
"tags",
"agent.ephemeral_id",
...
The issue seems to be that I have overlapping index template patterns:
winlogbeat-7.12.1 [winlogbeat-7.12.1-*] 1
.opensearch-sap-alias-mappings-index-template-winlogbeat- [winlogbeat-*] 0 [.opensearch-sap-alias-mappings-component-winlogbeat-]
and now:
[2023-01-24T09:15:29,837][WARN ][o.o.c.m.MetadataIndexTemplateService] [os-sea01.nwra.com] index template [.opensearch-sap-alias-mappings-index-template-winlogbeat-] has index patterns [winlogbeat-*] matching patterns from existing older templates [winlogbeat-7.12.1] with patterns (winlogbeat-7.12.1 => [winlogbeat-7.12.1-*]); this template [.opensearch-sap-alias-mappings-index-template-winlogbeat-] will take precedence during new index creation
which seems to be new behavior.
If I try to delete that template though I get a 404 error:
# curl -X DELETE "https://XXX:9200/_template/.opensearch-sap-alias-mappings-index-template-winlogbeat-"
{"error":{"root_cause":[{"type":"index_template_missing_exception","reason":"index_template [.opensearch-sap-alias-mappings-index-template-winlogbeat-] missing"}],"type":"index_template_missing_exception","reason":"index_template [.opensearch-sap-alias-mappings-index-template-winlogbeat-] missing"},"status":404}
):
I will have to…