# Beats OSS with OpenSearch 3.x

**URL:** <https://forum.opensearch.org/t/beats-oss-with-opensearch-3-x/25955>\
**Category:** OpenSearch\
**Created:** [July 22, 2025, 6:07am UTC](https://forum.opensearch.org/t/beats-oss-with-opensearch-3-x/25955 "2025-07-22T06:07:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marekvesely02](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@marekvesely02](https://forum.opensearch.org/u/marekvesely02)\
**Post date:** [July 22, 2025, 6:07am UTC](https://forum.opensearch.org/t/beats-oss-with-opensearch-3-x/25955/1 "2025-07-22T06:07:25Z")

</div>

Hi,

I would like to use Beats with OpenSearch 3.1. I found the compatibility matrices at [Tools - OpenSearch Documentation](https://docs.opensearch.org/docs/latest/tools/#compatibility-matrices). However, it only contains a row for OpenSearch 1.x to 2.x (no OpenSearch 3.x). Are the Beats OSS 7.12.x\* versions compatible with OpenSearch 3.x?

I am trying to avoid using Logstash as a middleware between Beats and OpenSearch, because I need to authenticate the individual VMs running Beats to collect data about the commands issued on them. I.e. each VM should have a set of credentials and write access to its own index. No other VM can write to that index.

Thanks,

Marek

---

<div class="post-metadata">

**Author:** ![marekvesely02](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@marekvesely02](https://forum.opensearch.org/u/marekvesely02)\
**Post date:** [July 22, 2025, 7:01am UTC](https://forum.opensearch.org/t/beats-oss-with-opensearch-3-x/25955/2 "2025-07-22T07:01:59Z")

</div>

To extend, I’ve tried running OpenSearch 3.1 together with Filebeat OSS 7.12.1, but was unable to change the necessary override\_main\_response\_version setting:

```auto
{"error":{"root_cause":[{"type":"settings_exception","reason":"persistent setting [compatibility.override_main_response_version], not recognized"}],"type":"settings_exception","reason":"persistent setting [compatibility.override_main_response_version], not recognized"},"status":400}

```

Was this option removed in OpenSearch 3.0/3.1? I don’t see such change in the changelog.

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 22, 2025, 7:50am UTC](https://forum.opensearch.org/t/beats-oss-with-opensearch-3-x/25955/3 "2025-07-22T07:50:59Z")

</div>

Elastic has introduced a version check in Filebeat 7.13. It won’t allow you to connect with OpenSearch.

As a result _compatibility.override\_main\_response\_version_ has been removed in 3.X.

You can try using Logstash with the OpenSearch output plugin and newer Filebeat as a workaround.