Setup issue for Filebeat OSS

General Feedback
1

Hello all,
When we try to setup Filebeat (OSS version) connect to OpenSearch
and seems to have some issues while creating the index template.
Therefore we still cannot ship windows IIS log to OpenSearch

Our test environment

Filebeat OSS version (7.10.2 and 7.14.1) on Windows machine
OpenSearch backend (1.0 and 1.0.1) on Linux Ubuntu 20.04

2021-09-14T09:41:15.683+0800 ERROR instance/beat.go:956 Exiting: error loading template: could not load template. Elasticsearch returned: couldn’t load template: 400 Bad Request: {“error”:{“root_cause”:[{“type”:“mapper_parsing_exception”,“reason”:"Root mapping definition has unsupported parameters: [default : {_meta={beat=filebeat, version=7.10.2}, dynamic_templates=[{labels={path_match=labels., mapping={type=keyword}, match_mapping_type=string}}, {container.labels={path_match=container.labels., mapping={type=keyword}, match_mapping_type=string}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, …

2

The correct version of Filebeat for OpenSearch is 7.12.1 - give that a try.

3

Same probleme for me, with 7.10.2 and 7.12.1 oss filebeat version. Someone have found a solution ?

with opensearch :1.0.0
{
“name” : “elastic-02”,
“cluster_name” : “opensearch”,
“cluster_uuid” : “11J50gSqT9CTvL5K-xgrSw”,
“version” : {
“distribution” : “opensearch”,
“number” : “1.0.0”,
“build_type” : “tar”,
“build_hash” : “34550c5b17124ddc59458ef774f6b43a086522e3”,
“build_date” : “2021-07-02T23:22:21.383695Z”,
“build_snapshot” : false,
“lucene_version” : “8.8.2”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “The OpenSearch Project: https://opensearch.org/”
}

4

@piellick You’re getting the same exact error as @Henry ?

7

already solved, github issue Document override_main_response_version · Issue #72 · opensearch-project/documentation-website · GitHub

1 Like