Filebeat 7.12.1 unable to send the logs to opensearch 2.19.3

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

filebeat version 7.12.1

opensearch version 2.19.3

os ubnutu 22.04 LTS

Describe the issue:

filebeat service always failed

getting below error while run filebeat manually

2025-08-20T16:19:58.371+0530    INFO    \[index-management\]      idxmgmt/std.go:184      Set output.elasticsearch.index to ‘filebeat-7.12.1’ as ILM is enabled.
2025-08-20T16:19:58.371+0530    WARN    \[cfgwarn\]       tlscommon/config.go:101 DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
2025-08-20T16:19:58.373+0530    INFO    eslegclient/connection.go:99    elasticsearch url: https://127.0.0.1:16577
2025-08-20T16:19:58.373+0530    WARN    \[tls\]   tlscommon/tls_config.go:98      SSL/TLS verifications disabled.
2025-08-20T16:19:58.373+0530    INFO    \[publisher\]     pipeline/module.go:113  Beat name: test
runtime/cgo: pthread_create failed: Operation not permitted
SIGABRT: abort

Configuration:

filebeat.inputs:

* type: log
  enabled: true
  paths:
  * /var/log/data/\**/\*.*log
  * /var/log/data/\**/\**.json

processors:
  - add_fields:
      target: ''
      fields:
        type: "Fatt"
  - decode_json_fields:
      fields: ["message"]
      target: ""
      overwrite_keys: true

# Global processors

processors:

* add_host_metadata: \~
* add_cloud_metadata: \~

# Output to OpenSearch

output.elasticsearch:
hosts: \[“https://127.0.0.1:16577”\]
username: “admin”
password: “Av4t4r3d-i5n”
index: “filebeat-%{+yyyy.MM.dd}”

ssl.enabled: true
ssl.verification_mode: none  # Change to ‘full’ if using proper CA
ssl.certificate_authorities: \[“/etc/opensearch/root-ca.pem”\]
ssl.certificate: “/etc/opensearch/esnode.pem”
ssl.key: “/etc/opensearch/esnode-key.pem”

# Filebeat internal paths

path.data: /var/lib/filebeat
path.logs: /var/log/filebeat

# Template setup (disabled since you’re using OpenSearch)

setup.template.enabled: false

Relevant Logs or Screenshots:

image
image1323×263 24.1 KB

image
image1316×274 26.3 KB

2

@kirankalelkar I’ve got the same behaviour on Ubuntu 24.04. It looks like related to the seccomp.

I’ve used this setting and filbeat worked at every run in both 22.04 and 24.04. I had no issues in Ubuntu 20.04

export FILEBEAT_SEC_COMP=false

According to the GitHub issue it should be fixed in 7.15 or 7.16. However, I understand that you’re connecting directly to OpenSearch and all versions above 7.13 will fail to connect due to version check.

The alternative is to use a newer version of the Filebeat with Logstash and Logstash OpenSearch output plugin.

3

@pablo my requirement is send logs from filebeat to direct opensearch output without logstash.

4

@kirankalelkar In that case, you need to try disabling seccomp or upgrading Ubuntu.

I’m not aware of any work regarding the OpenSearch output plugin for Beats.