Ecs disabled logstash errors

General Feedback
, ,
1

Hello
I disabled ecs comptability to avoid ecs warnings ,getting opensearch plugin errors

logstash.yml
pipeline.ecs_compatibility: disabled

logstash | OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.

logstash | [2022-07-16T00:30:35,307][INFO ][logstash.runner ] Starting Logstash {“logstash.version”=>“7.16.2”, “jruby.version”=>“jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]”}

logstash | [2022-07-16T00:30:42,097][ERROR][logstash.outputs.opensearch][c2tasks] Failed to install template {:message=>“Failed to load default template for OpenSearch v2 with ECS disabled; caused by: #<ArgumentError: Template file ‘/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json’ could not be found>”, :exception=>RuntimeError, :backtrace=>[“/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:33:in load_default_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:21:in install_template’”, “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:412:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:247:in finish_register’”, “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:224:in block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/plugin_mixins/opensearch/common.rb:83:in block in after_successful_connection’”]}
logstash | [2022-07-16T00:30:42,106][ERROR][logstash.outputs.opensearch][hybridpolling] Failed to install template {:message=>“Failed to load default template for OpenSearch v2 with ECS disabled; caused by: #<ArgumentError: Template file ‘/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json’ could not be found>”, :exception=>RuntimeError, :backtrace=>[“/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:33:in load_default_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:21:in install_template’”, “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:412:in install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:247:in finish_register’”, “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:224:in block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/plugin_mixins/opensearch/common.rb:83:in block in after_successful_connection’”]}

2

Hello,

Got the same logstash (7.16.3) error after an install of Opensearch 2.2.0

Beats data arrive into elasticsearch but the “GET _cat/templates?v” request do only return the headers → “name index_patterns order version composed_of” without the any templates in the list.

Have anyone been able to find a solution for this issue?

3

bash-4.2$ ls /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/ -al
total 8
drwxr-xr-x 2 logstash logstash 36 Dec 20 2021 .
drwxr-xr-x 3 logstash logstash 26 Dec 20 2021 …
-rw-r–r-- 1 logstash logstash 1059 Dec 20 2021 1x.json
-rw-r–r-- 1 logstash logstash 1059 Dec 20 2021 7x.json

cp /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/1x.json /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json
4

Great, everything works as intended after template copy & rename