Opensearch 2.1 and Robcowart Elastiflow 4.0.1 Connection Problems

OpenSearch
1

Hello,

I have and connectionproblem between Opensearch 2.1.0 and Robcowart Elastiflow 4.0.1 running on a Kubernetes Cluster.
I have updated Opensearch to 2.1.0, after that I have updated Robcowarts Elastiflow to 4.0.1 because the running 3.5.3 ist not longer compatible. First I had the problem with a not installing template. This I have fixed with removing three lines in the template json and building a new image. The tipp I found with google. Now I get always the error:

[ERROR][logstash.outputs.elasticsearch][elastiflow][5db33ca85bcb5abdc263f7e9c5b0afea0acd51612c97d3a3d1bd6ed1b8498a9b] Encountered a retryable error. Will Retry with exponential backoff {:code=>400, :url=>“https://opensearch:9200/_bulk”, :body=>“{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"}],"type":"illegal_argument_exception","reason":"Action/metadata line [1] contains an unknown parameter [_type]"},"status":400}”}

and no index will create in Opensearch.
Opensearch 1.3.4 and Robcowart Elastiflow 3.5.3 ware running without problems.
The parameter “override_main_response_version”: true is set in the opensearch.yml.

Have anybody an idea ti fix the problem? In google I read something with removing _type field, but no solution for the problem. please can someone help me?

Regards, fensterbrett.

1 Like
2

Hey could you drop your Elastiflow collector config in here? Looking over your logs I would expect this to break because it seems like Logstash is using the Elasticsearch output connector which would have worked with OpenSearch 1.x.x but is deprecated for the 2.x line. Going forward I believe there is a setting in elasticflow to specify the OpenSearch output plugin should be used.

Check out this config reference: OpenSearch | ElastiFlow

3

Hello,

thank you for support. But the parameter don’t take affect and will not fix the problem.
I tried the parameter in the docu and a “translated” version like the other Rob Cowart parameters.

Regards, fensterbrett

4
1 Like