# Relying on default value of \`pipeline.ecs\_compatibility\`, which may change in a future major release of Logstas

**URL:** https://forum.opensearch.org/t/relying-on-default-value-of-pipeline-ecs-compatibility-which-may-change-in-a-future-major-release-of-logstas/9983
**Category:** General Feedback
**Created:** [June 20, 2022, 8:59am UTC](https://forum.opensearch.org/t/relying-on-default-value-of-pipeline-ecs-compatibility-which-may-change-in-a-future-major-release-of-logstas/9983 "2022-06-20T08:59:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![deleugpn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/deleugpn/32/3449_2.png) [@deleugpn](https://forum.opensearch.org/u/deleugpn)
#### Post date: [June 20, 2022, 8:59am UTC](https://forum.opensearch.org/t/relying-on-default-value-of-pipeline-ecs-compatibility-which-may-change-in-a-future-major-release-of-logstas/9983/1 "2022-06-20T08:59:52Z")

</div>

Hey people,

I’m trying to get rid of this message which is flooding my CloudWatch. My setup is as follows:

```auto
...
ContainerDefinitions:
        - Essential: true
          Image: opensearchproject/logstash-oss-with-opensearch-output-plugin:7.16.2
          Command:
            - "-e"
            - !Sub |
                input {
                   tcp {
                     port => 9601
                     codec => json
                   }

                   udp {
                     port => 9602
                     codec => json
                   }

                   sqs {
                     queue => "${LogstashFallbackQueue.QueueName}"
                     id_field => "sqs_id"
                     polling_frequency => 20
                     region => "${AWS::Region}"
                     threads => 1
                  }
                }
                filter {
                  mutate {
                    remove_field => ["path", "host", "port"]
                  }
                }
                output {
                  opensearch {
                    index => "logstash-%{+YYYY.MM.dd}"
                    hosts => ["${OpensearchEndpoint}"]
                    auth_type => {
                      type => "aws_iam"
                      region => "${AWS::Region}"
                    }
                  }
                }
          Name: logstash
...

```

I have been trying to find information on what I need to change to get rid of this message, but most search results seem to be from Elasticsearch and not this specific plugin for Opensearch.

---

<div class="post-metadata">

### Author: ![jdbright](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jdbright/32/4979_2.png) [@jdbright](https://forum.opensearch.org/u/jdbright)
#### Post date: [June 27, 2022, 9:48pm UTC](https://forum.opensearch.org/t/relying-on-default-value-of-pipeline-ecs-compatibility-which-may-change-in-a-future-major-release-of-logstas/9983/2 "2022-06-27T21:48:59Z")

</div>

Hi @deleugpn,

What version of Logstash are you using? Logstash OSS 8.0 introduces a breaking change where all plugins run in ECS compatibility mode by default. If you use a compatible [OSS client](https://opensearch.org/docs/latest/clients/agents-and-ingestion-tools/index/#compatibility-matrices) you must override the default value to maintain legacy behavior:

`ecs_compatibility => disabled`

Please let us know if you still run into the issue once making the adjustment to your Logstash config.

---

<div class="post-metadata">

### Author: ![nomanlatif](https://avatars.discourse-cdn.com/v4/letter/n/bc79bd/32.png) [@nomanlatif](https://forum.opensearch.org/u/nomanlatif)
#### Post date: [June 28, 2022, 7:34am UTC](https://forum.opensearch.org/t/relying-on-default-value-of-pipeline-ecs-compatibility-which-may-change-in-a-future-major-release-of-logstas/9983/3 "2022-06-28T07:34:05Z")

</div>

I have the same warning message. I have logstash version 7.16.3.  
I set the ecs\_compatibility = disabled on pipeline level, it helped to reduce some warnings but still, some warnings are there. I have tried to set ecs\_compatibility =\> disabled in pipelines as well. but no luck.

I have tried this as well, but no luck

> **[Loading data into Amazon OpenSearch Service with Logstash - Amazon OpenSearch...](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-logstash.html)**
>
> The open source version of Logstash (Logstash OSS) provides a convenient way to use the bulk API to upload data into your Amazon OpenSearch Service domain. The service supports all standard Logstash input plugins, including the Amazon S3 input...

Additionally, we see the following error, it seems it tries to look for 2x.json template and that does not exist. Do we need to install something special?

`[2022-06-27T12:23:17,971][ERROR][logstash.outputs.opensearch][my_pipeline] Failed to install template {:message=>"Failed to load default template for OpenSearch v2 with ECS disabled; caused by: #<ArgumentError: Template file '/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/templates/ecs-disabled/2x.json' could not be found>", :exception=>RuntimeError, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template_manager.rb:33:in `load\_default\_template’", “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch/template\_manager.rb:21:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:412:in `install\_template’”, “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:247:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/outputs/opensearch.rb:224:in `block in register’”, "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-opensearch-1.2.0-java/lib/logstash/plugin\_mixins/opensearch/common.rb:83:in `block in after_successful_connection'"]}`
