Do the Elastic Beats work with Opensearch 2.4.1?

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.4.1

Hello! I’m trying to make work a Filebeat OSS (7.10.2) shipping logs to Logstash OSS (7.10.2) and finally into a Opensearch 2.4.1.

Despite the fact I had the following line into my opensearch.yml :

compatibility.override_main_response_version: true

I still have this error message in Logstash :

[2023-01-20T18:36:22,391][ERROR][logstash.outputs.elasticsearch][pipeline_talend_integration][fb11f0d10cc2223adc57b45e4be793eb6d7729175e0a262f49a5fa80d7520cd0] Encountered a retryable error. Will Retry with exponential backoff {:code=>400, :url=>“https://localhost:9200/_bulk”, :body=>“{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"}],"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"},"status":400}”}

Could you please help me? How to resolve this?

Best regards!

There’s an OpenSearch output to Logstash that you can use in order to fix this. You can download Logstash with the bundled OpenSearch output as described here: Logstash - OpenSearch documentation

For the moment you basically have to replace “elasticsearch” with “opensearch” in the output name.

1 Like

Ok I will try. It’s just too bad this Logstash (with embedded opensearch output ) doesn’t exists on Windows, to make some tests…

Oh, that’s unfortunate.

Can you try a quick one by setting document_type to nil ?

With document_type => nil it doesn’t work neither… however, with Logstash (with the opensearch output plugin), it works fine!

1 Like