# Do the Elastic Beats work with Opensearch 2.4.1?

**URL:** <https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213>\
**Category:** OpenSearch\
**Tags:** all-clients\
**Created:** [January 20, 2023, 5:39pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213 "2023-01-20T17:39:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [January 20, 2023, 5:39pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213/1 "2023-01-20T17:39:13Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.4.1

Hello! I’m trying to make work a Filebeat OSS (7.10.2) shipping logs to Logstash OSS (7.10.2) and finally into a Opensearch 2.4.1.

Despite the fact I had the following line into my opensearch.yml :

> compatibility.override\_main\_response\_version: true

I still have this error message in Logstash :

> [2023-01-20T18:36:22,391][ERROR][logstash.outputs.elasticsearch][pipeline\_talend\_integration][fb11f0d10cc2223adc57b45e4be793eb6d7729175e0a262f49a5fa80d7520cd0] Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>“[https://localhost:9200/\_bulk](https://localhost:9200/_bulk)”, :body=\>“{"error":{"root\_cause":[{"type":"illegal\_argument\_exception","reason":"Action/metadata line [1] contains an unknown parameter [\_type]"}],"type":"illegal\_argument\_exception","reason":"Action/metadata line [1] contains an unknown parameter [\_type]"},"status":400}”}

Could you please help me? How to resolve this?

Best regards!

---

<div class="post-metadata">

**Author:** ![radu.gheorghe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/radu.gheorghe/32/3516_2.png) [@radu.gheorghe](https://forum.opensearch.org/u/radu.gheorghe)\
**Post date:** [January 23, 2023, 1:57pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213/2 "2023-01-23T13:57:47Z")

</div>

There’s an OpenSearch output to Logstash that you can use in order to fix this. You can download Logstash with the bundled OpenSearch output as described here: [Logstash - OpenSearch documentation](https://opensearch.org/docs/2.4/tools/logstash/index/)

For the moment you basically have to replace “elasticsearch” with “opensearch” in the output name.

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [January 23, 2023, 2:11pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213/3 "2023-01-23T14:11:22Z")

</div>

Ok I will try. It’s just too bad this Logstash (with embedded opensearch output ) doesn’t exists on Windows, to make some tests…

---

<div class="post-metadata">

**Author:** ![radu.gheorghe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/radu.gheorghe/32/3516_2.png) [@radu.gheorghe](https://forum.opensearch.org/u/radu.gheorghe)\
**Post date:** [January 23, 2023, 2:24pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213/4 "2023-01-23T14:24:02Z")

</div>

Oh, that’s unfortunate.

Can you try a quick one by setting [document\_type](https://www.elastic.co/guide/en/logstash/7.10/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document_type) to `nil` ?

---

<div class="post-metadata">

**Author:** ![vincent2mots](https://avatars.discourse-cdn.com/v4/letter/v/e36b37/32.png) [@vincent2mots](https://forum.opensearch.org/u/vincent2mots)\
**Post date:** [January 26, 2023, 6:10pm UTC](https://forum.opensearch.org/t/do-the-elastic-beats-work-with-opensearch-2-4-1/12213/5 "2023-01-26T18:10:32Z")

</div>

With document\_type =\> nil it doesn’t work neither… however, with Logstash (with the opensearch output plugin), it works fine!