Wazuh-indexer will not ingest from logstash because Action/metadata line [1] contains an unknown parameter [_type]

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

wazuh-indexer, wazuh-dashboard

Describe the issue:
:body=>"{\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"Action/metadata line [1] contains an unknown parameter [_type]\"}]

This started when I upgraded wazuh-indexer and wazuh-dashboard.

How do I fix this issue? Seems like a bug and should be fixed on the backend.

2

I think it stems from this.
I know _type was removed quite a while ago so you would just need to have that field dropped in whatever is indexing the data. YMMV.

3

How do I go about dropping the field?

4

Might be best to ask wazuh ?

5

does wazuh-indexer have a way to ingest from logstash?