# Setting up filebeat module ibmmq on opensearch

**URL:** <https://forum.opensearch.org/t/setting-up-filebeat-module-ibmmq-on-opensearch/16199>\
**Category:** OpenSearch\
**Created:** [October 9, 2023, 2:58pm UTC](https://forum.opensearch.org/t/setting-up-filebeat-module-ibmmq-on-opensearch/16199 "2023-10-09T14:58:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wei](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@wei](https://forum.opensearch.org/u/wei)\
**Post date:** [October 9, 2023, 2:58pm UTC](https://forum.opensearch.org/t/setting-up-filebeat-module-ibmmq-on-opensearch/16199/1 "2023-10-09T14:58:52Z")

</div>

**opensearch 2.10.0, filebeat 7.17.13 logstash 8.9.0** (relevant - OpenSearch/Dashboard/Server OS/Browser):

I have a setup on my local machine of filebeat → logstash → opensearch trying to mirror production which has filebeat → logstash → elasticsearch as poc for migration from elasticsearch to opensearch. I am using the non-oss version of filebeat and the oss version of logstash.

I am trying to enable and install the module ibmmq with filebeat using this command.

`filebeat setup -e -E output.logstash.enabled=false -E setup.kibana.ssl.enabled=false -E output.elasticsearch.ssl.verification_mode=none -E output.elasticsearch.username=admin -E output.elasticsearch.password=admin -E output.elasticsearch.hosts=['https://os02:9200']`

but am getting an error:

> 2023-10-09T14:42:00.157Z ERROR instance/beat.go:1027 Exiting: error loading template: failed to load template: couldn’t load template: 400 Bad Request: {“error”:{“root\_cause”:[{“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”}],“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”},“status”:400}. Response body: {“error”:{“root\_cause”:[{“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”}],“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”},“status”:400}
> 
> Exiting: error loading template: failed to load template: couldn’t load template: 400 Bad Request: {“error”:{“root\_cause”:[{“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”}],“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”},“status”:400}. Response body: {“error”:{“root\_cause”:[{“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”}],“type”:“x\_content\_parse\_exception”,“reason”:“[1:13] [index\_template] template doesn’t support values of type: VALUE\_STRING”},“status”:400}

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 31, 2023, 11:10am UTC](https://forum.opensearch.org/t/setting-up-filebeat-module-ibmmq-on-opensearch/16199/2 "2023-10-31T11:10:47Z")

</div>

@wei You’ve stated that you are trying to replicate filebeat → logstash → elasticsearch with filebeat → logstash → opensearch.  
But in your command, you’ve disabled the logstash plugin.  
Also, to output data from Logstash to OpenSearch, you must use the OpenSearch output plugin.

> **[Logstash](https://opensearch.org/docs/latest/tools/logstash/index/#install-logstash)**
>
> Logstash

Regarding the filebeat version, 7.17.13 is not supported as per OS Documentation.

> **[Agents and ingestion tools](https://opensearch.org/docs/1.0/clients/agents-and-ingestion-tools/index/#downloads)**
>
> Agents and ingestion tools

---

<div class="post-metadata">

**Author:** ![wei](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@wei](https://forum.opensearch.org/u/wei)\
**Post date:** [October 31, 2023, 12:12pm UTC](https://forum.opensearch.org/t/setting-up-filebeat-module-ibmmq-on-opensearch/16199/3 "2023-10-31T12:12:15Z")

</div>

Hi Pablo,

According to filebeat, in order to install the module to the opensearch I need to directly connect to opensearch with filebeat first. This seems to be an issue with kibana dashboards and opensearch. I was able to get this working by manually recreating the dashboards in opensearch.