# Setup issue for Filebeat OSS

**URL:** https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046
**Category:** General Feedback
**Created:** [September 17, 2021, 1:10pm UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046 "2021-09-17T13:10:02Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Henry](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/henry/32/2141_2.png) [@Henry](https://forum.opensearch.org/u/Henry)
#### Post date: [September 17, 2021, 1:10pm UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046/1 "2021-09-17T13:10:02Z")

</div>

Hello all,  
When we try to setup Filebeat (OSS version) connect to OpenSearch  
and seems to have some issues while creating the index template.  
Therefore we still cannot ship windows IIS log to OpenSearch

Our test environment

> Filebeat OSS version (7.10.2 and 7.14.1) on Windows machine  
> OpenSearch backend (1.0 and 1.0.1) on Linux Ubuntu 20.04

* * *

2021-09-14T09:41:15.683+0800 ERROR instance/beat.go:956 Exiting: error loading template: could not load template. Elasticsearch returned: couldn’t load template: 400 Bad Request: {“error”:{“root\_cause”:[{“type”:“mapper\_parsing\_exception”,“reason”:"Root mapping definition has unsupported parameters: [_default_ : {\_meta={beat=filebeat, version=7.10.2}, dynamic\_templates=[{labels={path\_match=labels._, mapping={type=keyword}, match\_mapping\_type=string}}, {container.labels={path\_match=container.labels._, mapping={type=keyword}, match\_mapping\_type=string}}, {fields={path\_match=fields.\*, mapping={type=keyword}, match\_mapping\_type=string}}, …

* * *

---

<div class="post-metadata">

### Author: ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)
#### Post date: [September 17, 2021, 1:48pm UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046/2 "2021-09-17T13:48:15Z")

</div>

The correct version of Filebeat for OpenSearch is 7.12.1 - give that a try.

> **[Agents and ingestion tools](https://opensearch.org/docs/latest/clients/agents-and-ingestion-tools/index/)**
>
> Agents and ingestion tools

---

<div class="post-metadata">

### Author: ![piellick](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@piellick](https://forum.opensearch.org/u/piellick)
#### Post date: [September 22, 2021, 9:01pm UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046/3 "2021-09-22T21:01:20Z")

</div>

Same probleme for me, with 7.10.2 and 7.12.1 oss filebeat version. Someone have found a solution ?

with opensearch :1.0.0  
{  
“name” : “elastic-02”,  
“cluster\_name” : “opensearch”,  
“cluster\_uuid” : “11J50gSqT9CTvL5K-xgrSw”,  
“version” : {  
“distribution” : “opensearch”,  
“number” : “1.0.0”,  
“build\_type” : “tar”,  
“build\_hash” : “34550c5b17124ddc59458ef774f6b43a086522e3”,  
“build\_date” : “2021-07-02T23:22:21.383695Z”,  
“build\_snapshot” : false,  
“lucene\_version” : “8.8.2”,  
“minimum\_wire\_compatibility\_version” : “6.8.0”,  
“minimum\_index\_compatibility\_version” : “6.0.0-beta1”  
},  
“tagline” : “The OpenSearch Project: [https://opensearch.org/](https://opensearch.org/)”  
}

---

<div class="post-metadata">

### Author: ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)
#### Post date: [September 23, 2021, 1:41pm UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046/4 "2021-09-23T13:41:17Z")

</div>

@piellick You’re getting the same exact error as @Henry ?

---

<div class="post-metadata">

### Author: ![feng](https://avatars.discourse-cdn.com/v4/letter/f/82dd89/32.png) [@feng](https://forum.opensearch.org/u/feng)
#### Post date: [October 15, 2021, 2:43am UTC](https://forum.opensearch.org/t/setup-issue-for-filebeat-oss/7046/7 "2021-10-15T02:43:35Z")

</div>

already solved, github issue [Document override\_main\_response\_version · Issue #72 · opensearch-project/documentation-website · GitHub](https://github.com/opensearch-project/documentation-website/issues/72)
