# Logstash output OpenSearch compatibility

**URL:** <https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920>\
**Category:** OpenSearch Client Libraries\
**Tags:** clients-general\
**Created:** [March 3, 2023, 1:50pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920 "2023-03-03T13:50:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohamed.sarjoon](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@mohamed.sarjoon](https://forum.opensearch.org/u/mohamed.sarjoon)\
**Post date:** [March 3, 2023, 1:50pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/1 "2023-03-03T13:50:51Z")

</div>

Hi Team,

We are planning to upgrade from OpenSearch 1.x to 2.x, along with it we are also planning to upgrade logstash and filebeat to 8.x. But we are not able to find version compatibilty between beats and  
logstash-output-opensearch plugin.

Is Beat 8.x compatible with Logstash OSS with OpenSearch Output Plugin 8.x?

Also as per Beats 8.x breaking [changes](https://www.elastic.co/guide/en/beats/libbeat/8.0/breaking-changes-8.0.html), the beat logs are now ECS compliant, does this impact its compatibilty with opensearch?

Regards,  
Sarjoon

---

<div class="post-metadata">

**Author:** ![wbeckler](https://avatars.discourse-cdn.com/v4/letter/w/9d8465/32.png) [@wbeckler](https://forum.opensearch.org/u/wbeckler)\
**Post date:** [March 5, 2023, 12:58am UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/2 "2023-03-05T00:58:39Z")

</div>

You might run into this: [https://logz.io/blog/breaking-change-to-beats-impacts-elasticsearch-elk-stack-users/](https://logz.io/blog/breaking-change-to-beats-impacts-elasticsearch-elk-stack-users/)

According to that post, Elastic added a breaking change in Beats v7.13 to block Beats from talking to older version of Elasticsearch or to OpenSearch.

---

<div class="post-metadata">

**Author:** ![roshdngr](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@roshdngr](https://forum.opensearch.org/u/roshdngr)\
**Post date:** [March 6, 2023, 3:08am UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/3 "2023-03-06T03:08:34Z")

</div>

Hey Sarjoon,

The OpenSearch Output Plugin is compatible with Logstash 8.x. However, looking at wbeckler’s response looks like you might run into some issues with Beats.

---

<div class="post-metadata">

**Author:** ![mohamed.sarjoon](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@mohamed.sarjoon](https://forum.opensearch.org/u/mohamed.sarjoon)\
**Post date:** [March 7, 2023, 2:10pm UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/4 "2023-03-07T14:10:49Z")

</div>

@wbeckler Thanks for the reply. we are already using Filebeat 7.16 with Logstash 7.16 and we didn’t faced this issue yet. Any idea does Filebeat 8.x introduces any other breaking changes? and particularly does ECS compliant beat logs introduce any break in opensearch stack?

---

<div class="post-metadata">

**Author:** ![wbeckler](https://avatars.discourse-cdn.com/v4/letter/w/9d8465/32.png) [@wbeckler](https://forum.opensearch.org/u/wbeckler)\
**Post date:** [March 15, 2023, 10:43am UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/5 "2023-03-15T10:43:29Z")

</div>

I don’t know the answer to what you’re asking about ECS.

I think the issue of the breaking change in 7.13 was regarding the scenario where beats is talking directly to your cluster rather than going via logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [May 14, 2023, 10:44am UTC](https://forum.opensearch.org/t/logstash-output-opensearch-compatibility/12920/6 "2023-05-14T10:44:07Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
