AWS Opensearch 1.2.4 with Filebeats OSS

Question

Hi,

Im trying to connect filebeat to AWS Opensearch, but keep hitting template issues. Filebeats errors with the following:

```
Connection marked as failed because the onConnect callback failed: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Request: {"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters:  [_default_]
```
If I manually export the template and load it into Opensearch I get the following:

```
{"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[1:51] [index_template] unknown field [mappings]"}],"type":"x_content_parse_exception","reason":"[1:51] [index_template] unknown field [mappings]"},"status":400
```
I would have assumed there is an out the box version of filebeat-oss that is compatible with Opensearch 1.2.4

Any suggestions?

Thanks

Answer

Resolved using the compatibility mode setting

```
PUT /_cluster/settings
{
  "persistent" : {
    "compatibility.override_main_response_version" : true
  }
}
```

AWS Opensearch 1.2.4 with Filebeats OSS

Relevant questions

Access to AWS Opensearch in a VPC

Connecting OpenSearch to QuickSight

Scale AWS OpenSearch