# Opensearch create index template issue

**URL:** <https://forum.opensearch.org/t/opensearch-create-index-template-issue/14406>\
**Category:** OpenSearch\
**Created:** [May 19, 2023, 9:07am UTC](https://forum.opensearch.org/t/opensearch-create-index-template-issue/14406 "2023-05-19T09:07:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emily](https://avatars.discourse-cdn.com/v4/letter/e/8c91f0/32.png) [@Emily](https://forum.opensearch.org/u/Emily)\
**Post date:** [May 19, 2023, 9:07am UTC](https://forum.opensearch.org/t/opensearch-create-index-template-issue/14406/1 "2023-05-19T09:07:46Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch verison is 1.2.3  
I am using filebeat 7.10.2 to create index template  
I met the error

`> Exiting: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}},"status":400}. Response body: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text}, policy_index={ignore_above=3, type=keyword}, reserve2={norms=false, index=false, type=text}, message={norms=false, index=true, type=text}, status_int={ignore_above=4, type=keyword}, object_text={norms=false, type=text}, account_text={norms=false, type=text}, @timestamp={type=date}, content_length_l={type=long}, request_path={norms=false, index=false, type=text}, auth_token={norms=false, index=false, type=text}, account={ignore_above=1024, type=keyword}}, date_detection=false}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [_default_ : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], properties={msg={norms=false, index=false, type=text}, container={ignore_above=1024, type=keyword}, referer={norms=false, index=false, type=text}, reason={norms=false, index=false, type=text}, instance={ignore_above=1024, index=true, type=keyword}, ed_time={type=date}, client_type={ignore_above=1024, type=keyword}, source={ignore_above=8, type=keyword}, wire_status_int={ignore_above=4, type=keyword}, path={norms=false, index=false, type=text}, protocol={ignore_above=16, index=false, type=keyword}, client_etag={norms=false, index=false, type=text}, host={properties={name={norms=false, type=text}}}, client_ip={type=ip}, sysloghost={ignore_above=64, type=keyword}, transaction_id={ignore_above=1024, type=keyword}, server_pid={index=false, type=long}, bytes_sent_l={type=long}, workflow={ignore_above=1024, index=true, type=keyword}, st_time={type=date}, ttfb_f={type=float}, nvratelimit={properties={request_time={type=float}, wire_status_int={ignore_above=4, type=keyword}}}, container_text={norms=false, type=text}, start_time={norms=false, index=false, type=text}, transfer_speed_long={type=long}, additional_info={norms=false, index=false, type=text}, object={ignore_above=1024, type=keyword}, upload_id={ignore_above=1024, index=true, type=keyword}, bytes_recvd_l={type=long}, programname={ignore_above=64, type=keyword}, log_info={norms=false, index=false, type=text}, request_method={ignore_above=8, type=keyword}, client_type_text={norms=false, type=text}, request_time={type=float}, rate={index=false, type=long}, user_agent={ignore_above=1024, type=keyword}, severity={ignore_above=16, type=keyword}, headers={properties={}}, remote_addr={index=false, type=ip}, reserve1={norms=false, index=false, type=text}, end_time={norms=false, index=false, type=text},...`

there is a “ **default** ” field under mapping, I don’t know why it was generated, and seems due to the **default** filebeat can’t setup index template

**Describe the issue** :

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Emily](https://avatars.discourse-cdn.com/v4/letter/e/8c91f0/32.png) [@Emily](https://forum.opensearch.org/u/Emily)\
**Post date:** [May 19, 2023, 9:31am UTC](https://forum.opensearch.org/t/opensearch-create-index-template-issue/14406/2 "2023-05-19T09:31:15Z")

</div>

I have find the solution

> <https://github.com/opensearch-project/documentation-website/issues/72>
>
> A cluster setting was introduced in https://github.com/opensearch-project/OpenSe…arch/pull/847. We removed the distribution in backwards-compatible mode in https://github.com/opensearch-project/OpenSearch/pull/898. Set \`compatibility.override\_main\_response\_version\` to put the cluster into a configuration that returns 7.10.2 as with ES OSS.
> 
> Currently https://docs-beta.opensearch.org/clients/agents-and-ingestion-tools/index/ point to "yes via a cluster setting" which links to https://github.com/opensearch-project/OpenSearch/issues/693, but should be linking to the documentation that explains how to set this setting.