# Filebeat 7.12.0 log parsing issue to opensearch 3.0.0

**URL:** <https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156>\
**Category:** OpenSearch\
**Tags:** troubleshoot\
**Created:** [July 29, 2025, 7:36am UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156 "2025-07-29T07:36:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kirankalelkar](https://avatars.discourse-cdn.com/v4/letter/k/c6cbf5/32.png) [@kirankalelkar](https://forum.opensearch.org/u/kirankalelkar)\
**Post date:** [July 29, 2025, 7:36am UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/1 "2025-07-29T07:36:02Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
i am using opensearch 3.0.0 and filebeat 7.12.0

**Describe the issue** :  
While send logs to opensearch using filebeat getting below error in filebeat status

```auto
ERROR [elasticsearch] elasticsearch/client.go:224 failed to perform any bulk index operations: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"}],"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"},"status":400}

```

**Configuration** :

filebeat configuration

```auto
# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/*.log

# ============================== Output to OpenSearch ===========================
output.elasticsearch:
  # OpenSearch URL and port
  hosts: ["https://127.0.0.1:9200"]

  protocol: "https"
  # Optional authentication (username and password) if needed
  username: "user"
  password: "passwd"

  # TLS settings
  ssl.enabled: true
  ssl.verification_mode: full # Optional, set to 'none' if not verifying certificates
  ssl.certificate_authorities: ["/etc/opensearch/ca.crt"] # Specify your CA certificate if necessary
  ssl.certificate: "/etc/opensearch/node.crt" # Optional if client certificates are needed
  ssl.key: "/etc/opensearch/node.key" # Optional if client certificates are needed

  # Set the index pattern for OpenSearch (or Elasticsearch)
  index: "filebeat-%{+yyyy.MM.dd}"

# ============================== Filebeat paths ================================
path.data: /var/lib/filebeat # Specify a directory for Filebeat's internal data

path.logs: /var/log/filebeat # Logs directory for Filebeat itself

setup.template.enabled: false
  #setup.template.type: "doc"
output.elasticsearch.document_type: "doc"

```

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/5/51e08b649dcc9ef2738c7cb53dcc53a64dda41b8.png)

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 29, 2025, 2:20pm UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/2 "2025-07-29T14:20:06Z")

</div>

Hey @kirankalelkar ,

Elastic has introduced a version check in Filebeat 7.13. So it won’t allow you to connect with OpenSearch 3.X. Last compatible version was filebeat 7.12.1 which worked for Opensearch 2.X.

As a result compatibility has been removed in 3.X.

You can try using Logstash with the OpenSearch output plugin and newer Filebeat as a workaround.

---

<div class="post-metadata">

**Author:** ![kirankalelkar](https://avatars.discourse-cdn.com/v4/letter/k/c6cbf5/32.png) [@kirankalelkar](https://forum.opensearch.org/u/kirankalelkar)\
**Post date:** [July 30, 2025, 10:29am UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/3 "2025-07-30T10:29:47Z")

</div>

> [@kirankalelkar](#):
>
> ```auto
> # ============================== Filebeat inputs ===============================
> 
> filebeat.inputs:
> 
> * type: log
> enabled: true
> paths:
> * /var/log/*.log
> 
> # ============================== Output to OpenSearch ===========================
> 
> output.elasticsearch:
> 
> # OpenSearch URL and port
> 
> hosts: [“https://127.0.0.1:9200”]
> 
> protocol: “https”
> 
> # Optional authentication (username and password) if needed
> 
> username: “user”
> password: “passwd”
> 
> # TLS settings
> 
> ssl.enabled: true
> ssl.verification_mode: full # Optional, set to ‘none’ if not verifying certificates
> ssl.certificate_authorities: [“/etc/opensearch/ca.crt”] # Specify your CA certificate if necessary
> ssl.certificate: “/etc/opensearch/node.crt” # Optional if client certificates are needed
> ssl.key: “/etc/opensearch/node.key” # Optional if client certificates are needed
> 
> # Set the index pattern for OpenSearch (or Elasticsearch)
> 
> index: “filebeat-%{+yyyy.MM.dd}”
> 
> # ============================== Filebeat paths ================================
> 
> path.data: /var/lib/filebeat # Specify a directory for Filebeat’s internal data
> 
> path.logs: /var/log/filebeat # Logs directory for Filebeat itself
> 
> setup.template.enabled: false
> #setup.template.type: “doc”
> output.elasticsearch.document_type: “doc”
> 
> ```

i tried using filebeat 7.12.1 and opensearch 2.19.3 but getting same issue

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/6/69e891ab7c753fc4d26367d78ba9ca0253843d93.png)

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 30, 2025, 11:39am UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/4 "2025-07-30T11:39:22Z")

</div>

Hi @kirankalelkar ,

I tested Filebeat and it works with 7.12.0 and 7.12.1 to Opensearch 2.19.2 and 2.19.3.

I am also doing this using Filebeats-oss. So please test with Filebeat-oss and let me know if you’re still having issues.

Supported versions can be found here - [Tools - OpenSearch Documentation](https://docs.opensearch.org/latest/tools/) .

Also you will see in the doc, but please also ensure you have _“override\_main\_response\_version”: true_ set in your opensearch.yml or set it using the following -

```auto
PUT _cluster/settings
{
  "persistent": {
    "compatibility": {
      "override_main_response_version": true
    }
  }
}

```

Leeroy.

---

<div class="post-metadata">

**Author:** ![kirankalelkar](https://avatars.discourse-cdn.com/v4/letter/k/c6cbf5/32.png) [@kirankalelkar](https://forum.opensearch.org/u/kirankalelkar)\
**Post date:** [July 31, 2025, 12:09pm UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/5 "2025-07-31T12:09:41Z")

</div>

```auto
Thank You. i am able to receive the logs.

```

---

<div class="post-metadata">

**Author:** ![jst](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jst](https://forum.opensearch.org/u/jst)\
**Post date:** [January 7, 2026, 3:40pm UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/6 "2026-01-07T15:40:32Z")

</div>

So there is currently no possibility to use the Beat software with OpenSearch-3.X?  
I just updated my OpenSearch cluster from 2.x to 3.4 and I have the same problem, now.

All Windows Clients are configured with Winlogbeat 7.12.1 and I receive no log data anymore….

When I try to configure the override command, that you recommended, I just get the error message, that the setting name is not recognized.

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [January 8, 2026, 12:57pm UTC](https://forum.opensearch.org/t/filebeat-7-12-0-log-parsing-issue-to-opensearch-3-0-0/26156/7 "2026-01-08T12:57:57Z")

</div>

Hi @jst ,

You’re correct. This does not work in 3.X, the only solution be to send beats via logstash to prevent compatibility issue.

Leeroy.