Configure action.destructive_requires_name in data node

UPGRADING.md

@@ -76,6 +76,10 @@ Not affected by this change are the following templates using Freemarker:
 | `disabled_retention_strategies`  | **added** | Disables the specified retention strategies. By default, strategies `none` and `close` are now disabled in new installations.<br/>Strategies can be re-enabled simply by removing from this list.<br/>**Do not extend this list on existing installs!** |
 | `field_value_suggestion_mode`    | **added** | Allows controlling field value suggestions, turning them on, off, or allowing them only for textual fields.                                                                                                                                             |
 
+## OpenSearch Configuration Changes
+
+- Due to a bug in the OpenSearch client, it is recommended to explicitly set `action.destructive_requires_name=true`
+  at cluster level to avoid problems. If you are using Graylog Data Node, this is automatically set for you.
 
 ## Asset Import Changes
 

changelog/unreleased/pr-18647.toml

@@ -0,0 +1,5 @@
+type = "f"
+message = "Explicitly set `action.destructive_requires_name` in data node."
+
+pulls = ["18647"]
+issues = ["18619"]

data-node/src/main/java/org/graylog/datanode/process/OpensearchConfiguration.java

@@ -50,6 +50,7 @@ public Map<String, String> asMap() {
         Map<String, String> config = new LinkedHashMap<>();
 
         config.put("action.auto_create_index", "false");
+        config.put("action.destructive_requires_name", "true"); // set to default value due to https://github.com/opensearch-project/opensearch-java/issues/894
 
         // currently, startup fails on macOS without disabling this filter.
         // for a description of the filter (although it's for ES), see https://www.elastic.co/guide/en/elasticsearch/reference/7.17/_system_call_filter_check.html