# Unable to send metric beat logs to opensearch

**URL:** <https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785>\
**Category:** General Feedback\
**Created:** [November 30, 2021, 10:11am UTC](https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785 "2021-11-30T10:11:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharath\_90](https://avatars.discourse-cdn.com/v4/letter/s/ad7895/32.png) [@sharath\_90](https://forum.opensearch.org/u/sharath_90)\
**Post date:** [November 30, 2021, 10:11am UTC](https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785/1 "2021-11-30T10:11:10Z")

</div>

I am facing below issue while trying to configure metric beats with opensearch.  
Please help me if there is any way to tweak version or to get this implemented in a simpler way.

> |2021-11-30T10:00:21.830Z|INFO|[esclientleg]|eslegclient/connection.go:273|Attempting to connect to Elasticsearch version 1.0.0  
> |2021-11-30T10:00:23.631Z|ERROR|[publisher\_pipeline\_output]|pipeline/output.go:154|Failed to connect to backoff(elasticsearch([https://10.0.238.17:9200](https://10.0.238.17:9200))): Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {error:{root\_cause:[{type:invalid\_index\_name\_exception,reason:Invalid index name [_license], must not start with '_‘.,index:\_license,index\_uuid:_na_}],type:invalid\_index\_name\_exception,reason:Invalid index name [_license], must not start with '_’.,index:\_license,index\_uuid:_na_},status:400}

I am using below metricbeat-kubernetes.yaml

```auto
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricbeat-daemonset-config
  namespace: logging
  labels:
    k8s-app: metricbeat
data:
  metricbeat.yml: |-
    metricbeat.config.modules:
      # Mounted `metricbeat-daemonset-modules` configmap:
      path: ${path.config}/modules.d/*.yml
      # Reload module configs as they change:
      reload.enabled: false

    metricbeat.autodiscover:
      providers:
        - type: kubernetes
          scope: cluster
          node: ${NODE_NAME}
          unique: true
          templates:
            - config:
                - module: kubernetes
                  hosts: ["kube-state-metrics.kube-system:8080"]
                  period: 10s
                  add_metadata: true
                  metricsets:
                    - state_node
                    - state_deployment
                    - state_daemonset
                    - state_replicaset
                    - state_pod
                    - state_container
                    - state_job
                    - state_cronjob
                    - state_resourcequota
                    - state_statefulset
                    - state_service
                - module: kubernetes
                  metricsets:
                    - apiserver
                  hosts: ["https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}"]
                  bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
                  ssl.certificate_authorities:
                    - /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                  period: 30s
                # Uncomment this to get k8s events:
                #- module: kubernetes
                # metricsets:
                # - event
        # To enable hints based autodiscover uncomment this:
        #- type: kubernetes
        # node: ${NODE_NAME}
        # hints.enabled: true

    processors:
      - add_cloud_metadata:

    cloud.id: ${ELASTIC_CLOUD_ID}
    cloud.auth: ${ELASTIC_CLOUD_AUTH}

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
      username: ${ELASTICSEARCH_USERNAME}
      password: ${ELASTICSEARCH_PASSWORD}
      ssl.enabled: "true"
      ssl.verification_mode: "none"
      ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricbeat-daemonset-modules
  namespace: logging
  labels:
    k8s-app: metricbeat
data:
  system.yml: |-
    - module: system
      period: 10s
      metricsets:
        - cpu
        - load
        - memory
        - network
        - process
        - process_summary
        #- core
        #- diskio
        #- socket
      processes: ['.*']
      process.include_top_n:
        by_cpu: 5 # include top 5 processes by CPU
        by_memory: 5 # include top 5 processes by memory

    - module: system
      period: 1m
      metricsets:
        - filesystem
        - fsstat
      processors:
      - drop_event.when.regexp:
          system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'
  kubernetes.yml: |-
    - module: kubernetes
      metricsets:
        - node
        - system
        - pod
        - container
        - volume
      period: 10s
      host: ${NODE_NAME}
      hosts: ["https://${NODE_NAME}:10250"]
      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      ssl.verification_mode: "none"
      # If there is a CA bundle that contains the issuer of the certificate used in the Kubelet API,
      # remove ssl.verification_mode entry and use the CA, for instance:
      #ssl.certificate_authorities:
        #- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
    # Currently `proxy` metricset is not supported on Openshift, comment out section
    - module: kubernetes
      metricsets:
        - proxy
      period: 10s
      host: ${NODE_NAME}
      hosts: ["localhost:10249"]
---
# Deploy a Metricbeat instance per node for node metrics retrieval
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: metricbeat
  namespace: logging
  labels:
    k8s-app: metricbeat
spec:
  selector:
    matchLabels:
      k8s-app: metricbeat
  template:
    metadata:
      labels:
        k8s-app: metricbeat
    spec:
      serviceAccountName: metricbeat
      terminationGracePeriodSeconds: 30
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - name: metricbeat
        image: docker.elastic.co/beats/metricbeat:7.15.2
        args: [
          "-c", "/etc/metricbeat.yml",
          "-e",
          "-system.hostfs=/hostfs",
        ]
        env:
        - name: ELASTICSEARCH_HOST
          value: "https://10.0.238.17"
        - name: ELASTICSEARCH_PORT
          value: "9200"
        - name: ELASTICSEARCH_USERNAME
          value: "admin"
        - name: ELASTICSEARCH_PASSWORD
          value: "admin"
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - name: config
          mountPath: /etc/metricbeat.yml
          readOnly: true
          subPath: metricbeat.yml
        - name: data
          mountPath: /usr/share/metricbeat/data
        - name: modules
          mountPath: /usr/share/metricbeat/modules.d
          readOnly: true
        - name: proc
          mountPath: /hostfs/proc
          readOnly: true
        - name: cgroup
          mountPath: /hostfs/sys/fs/cgroup
          readOnly: true
      volumes:
      - name: proc
        hostPath:
          path: /proc
      - name: cgroup
        hostPath:
          path: /sys/fs/cgroup
      - name: config
        configMap:
          defaultMode: 0640
          name: metricbeat-daemonset-config
      - name: modules
        configMap:
          defaultMode: 0640
          name: metricbeat-daemonset-modules
      - name: data
        hostPath:
          # When metricbeat runs as non-root user, this directory needs to be writable by group (g+w)
          path: /var/lib/metricbeat-data
          type: DirectoryOrCreate
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metricbeat
subjects:
- kind: ServiceAccount
  name: metricbeat
  namespace: logging
roleRef:
  kind: ClusterRole
  name: metricbeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: metricbeat
  namespace: logging
subjects:
  - kind: ServiceAccount
    name: metricbeat
    namespace: logging
roleRef:
  kind: Role
  name: metricbeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: metricbeat-kubeadm-config
  namespace: logging
subjects:
  - kind: ServiceAccount
    name: metricbeat
    namespace: logging
roleRef:
  kind: Role
  name: metricbeat-kubeadm-config
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: metricbeat
  labels:
    k8s-app: metricbeat
rules:
- apiGroups: [""]
  resources:
  - nodes
  - namespaces
  - events
  - pods
  - services
  verbs: ["get", "list", "watch"]
# Enable this rule only if planing to use Kubernetes keystore
#- apiGroups: [""]
# resources:
# - secrets
# verbs: ["get"]
- apiGroups: ["extensions"]
  resources:
  - replicasets
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources:
  - statefulsets
  - deployments
  - replicasets
  verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
  resources:
  - jobs
  verbs: ["get", "list", "watch"]
- apiGroups:
  - ""
  resources:
  - nodes/stats
  verbs:
  - get
- nonResourceURLs:
  - "/metrics"
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: metricbeat
  # should be the namespace where metricbeat is running
  namespace: logging
  labels:
    k8s-app: metricbeat
rules:
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs: ["get", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: metricbeat-kubeadm-config
  namespace: logging
  labels:
    k8s-app: metricbeat
rules:
  - apiGroups: [""]
    resources:
      - configmaps
    resourceNames:
      - kubeadm-config
    verbs: ["get"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: metricbeat
  namespace: logging
  labels:
    k8s-app: metricbeat
---

```

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [December 1, 2021, 12:54am UTC](https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785/2 "2021-12-01T00:54:32Z")

</div>

Two things - it looks like you are using the non-OSS version of metricbeat. There is an OSS version that doesn’t have the license check. Additionally, you should follow the compatibility matrix:

> **[Agents and ingestion tools](https://opensearch.org/docs/1.2/clients/agents-and-ingestion-tools/index/#compatibility-matrix-for-beats)**
>
> Agents and ingestion tools

---

<div class="post-metadata">

**Author:** ![sharath\_90](https://avatars.discourse-cdn.com/v4/letter/s/ad7895/32.png) [@sharath\_90](https://forum.opensearch.org/u/sharath_90)\
**Post date:** [December 1, 2021, 6:53am UTC](https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785/3 "2021-12-01T06:53:43Z")

</div>

Hi @searchymcsearchface

Thanks Kyle for your reply.  
I have made below two changes and data is flowing now.

Change1:

Change elasticsearch version using API call from opensearch dashboard \> Dev Tools

```auto
PUT /_cluster/settings
{
  "persistent" : {
    "compatibility" : {
      "override_main_response_version" : true
    }
  }
}

```

Change2:

User metricbeat oss image  
image: [docker.elastic.co/beats/metricbeat-oss:7.12.1](http://docker.elastic.co/beats/metricbeat-oss:7.12.1)

Now the question is are there any ready made dashboards that i can import to visualize metric beat data for system resources and kube rresources. If not, this is some improvement area that we can look out for.

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [December 1, 2021, 4:20pm UTC](https://forum.opensearch.org/t/unable-to-send-metric-beat-logs-to-opensearch/7785/4 "2021-12-01T16:20:17Z")

</div>

Great! Glad to hear it helped.

As for a ready made dashboard for k8s resources, I’m not really aware of one to be honest.