# Which beats for ingesting logs from Linux server into Opensearch 3.1

**URL:** <https://forum.opensearch.org/t/which-beats-for-ingesting-logs-from-linux-server-into-opensearch-3-1/25816>\
**Category:** OpenSearch\
**Tags:** configure, install\
**Created:** [July 17, 2025, 2:53pm UTC](https://forum.opensearch.org/t/which-beats-for-ingesting-logs-from-linux-server-into-opensearch-3-1/25816 "2025-07-17T14:53:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Detlef](https://forum.opensearch.org/u/Detlef)\
**Post date:** [July 17, 2025, 2:53pm UTC](https://forum.opensearch.org/t/which-beats-for-ingesting-logs-from-linux-server-into-opensearch-3-1/25816/1 "2025-07-17T14:53:19Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Opensearch 2.19  
Filebeat OSS: 7.12.1  
Server OS: RHEL 8/9

**Describe the issue** :  
I wanna use the newest version of Opensearch - version 3.1.  
At the moment I’m using Opensearch v2.19 and filebeat is sending the logs directly to Opensearch.  
Is this also possible with Opensearch v3.1 ? Which version of filebeat is supporting this ?  
Or do I have to send the logs by filebeat via logstash to Opensearch ?  
Which versions of filebeat and logstash has to be used in this case ?

I know the compatibility matrix, but it’s not so easy to understand.

Next step is ingesting logs from k8s cluster to Opensearch. I assume this is the same setup.

Thnx for any help !

Detlef

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [July 17, 2025, 8:02pm UTC](https://forum.opensearch.org/t/which-beats-for-ingesting-logs-from-linux-server-into-opensearch-3-1/25816/2 "2025-07-17T20:02:42Z")

</div>

@Detlef Elastic has introduced a version check in Filebeat 7.13. It won’t allow you to connect with OpenSearch.

```auto
filebeat-oss_7.13.0 | 2021-07-27T12:47:34.618Z ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://node-0.example.com:9200)): Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index_uuid":"_na_","index":"_license"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index_uuid":"_na_","index":"_license"},"status":400}
filebeat-oss_7.13.0 | 2021-07-27T12:47:34.618Z INFO [publisher_pipeline_output] pipeline/output.go:145 Attempting to reconnect to backoff(elasticsearch(https://node-0.example.com:9200)) with 2 reconnect attempt(s)

```

> [@Filebeat OSS fails upgrade version 7.13, required \_license index?](https://forum.opensearch.org/t/filebeat-oss-fails-upgrade-version-7-13-required-license-index/6025):
>
> This morning I upgraded the filebeat-oss package from version 7.12.1 to 7.13. It was working perfectly and after uprading the package it stopped working. Now fails with the following message: May 27 11:03:24 hostname filebeat[6466]: 2021-05-27T11:03:24.932+0200 ERROR [publisher\_pipeline\_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://ingest:9200)): Connection marked as failed because the onConnect callback failed: could not connect t…

Try using Logstash with the OpenSearch output plugin and newer Filebeat as a workaround.