# Data Prepper can not write to Opensearch Datastream \[BUG\] #2037

**URL:** <https://forum.opensearch.org/t/data-prepper-can-not-write-to-opensearch-datastream-bug-2037/16175>\
**Category:** Data Prepper\
**Created:** [October 6, 2023, 1:58pm UTC](https://forum.opensearch.org/t/data-prepper-can-not-write-to-opensearch-datastream-bug-2037/16175 "2023-10-06T13:58:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![godin.igor](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@godin.igor](https://forum.opensearch.org/u/godin.igor)\
**Post date:** [October 6, 2023, 1:58pm UTC](https://forum.opensearch.org/t/data-prepper-can-not-write-to-opensearch-datastream-bug-2037/16175/1 "2023-10-06T13:58:07Z")

</div>

Hello.  
There is a [bug report](https://github.com/opensearch-project/data-prepper/issues/2037) on github? And we get the same issue. Can not send logs to Opensearch Data stream:

Error “WARN com.amazon.dataprepper.plugins.sink.opensearch.OpenSearchSink - Document [org.opensearch.client.opensearch.core.bulk.BulkOperation@c4aecd] has failure: java.lang.RuntimeException: only write ops with an op\_type of create are allowed in data streams”

**Configuration** :  
data-prepper:latests, opensearch v 2.10.0,

```auto
kafka-sysmon_security_eventlog-pipeline:
  source:
    kafka:
      acknowledgments: true
      encryption:
          type: none
      bootstrap_servers:
        - xxxxxxxx:9094
        - xxxxxxxx:9095
        - xxxxxxxx:9096
      topics:
        - name: "sysmon_security_eventlog"
          group_id: "data_prepper"
          key_mode: "discard"
          serde_format: "json"
          auto_commit: true
  processor:
    - aggregate:
          identification_keys: ["event.provider","event.code","event.outcome","host.name","winlog.event_data.AuthenticationPackageName","winlog.event_data.TargetDomainName","winlog.event_data.TargetUserName","winlog.event_data.TargetUserSid","winlog.event_data.WorkstationName"]
          action:
            remove_duplicates:
          group_duration: 30s
  sink:
    - opensearch:
          hosts: ["https://xxxxxxxx:9200"]
          username: xxxxxxxx
          password: xxxxxxxx
          insecure: true
          connect_timeout: 60000
          index: logs-events-sysmon_security_eventlog
          index_type: management_disabled

```

Is any progress there ?  
The bug has been open for almost a year and so far nothing has moved, whereas this feature would be very necessary.  
Or is there some workaround?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [December 5, 2023, 1:58pm UTC](https://forum.opensearch.org/t/data-prepper-can-not-write-to-opensearch-datastream-bug-2037/16175/2 "2023-12-05T13:58:12Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.