OpenSearch support: Native Output Support & Icingabeat Dashboards for OpenSearch Dashboards

[pdolinic]

Hi,

I managed to get IcingaBeat v.7.17.4 running via a Logstash-OSS plugin forwarding to OpenSearch via this way: https://repost.aws/knowledge-center/opensearch-connect-filebeat-logstash .

a)

• Native-Output:
  Compared to this, Elasticsearch (8.8.2) (as an output) worked out-the-box without Logstash.
  -> The Problem is that 7.17.4 version is still unaware of the "OpenSearch output" keyword.
  Exiting: error initializing publisher: output type opensearch undefined
2023-08-08T13:04:49.985+0200 ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://10.3.0.171:9200)): Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"},"status":400}

b)

• Importing Icingabeat-Dashboards:
  -> I tried two things, firstly importing into Kibana, and then exporting into Opensearch Dashboards (Kibana for OpenSearch is called OpenSearch Dashboards).
  Secondly directly importing to OpenSearch.
  In both cases it appears some of the IDs and Strings are mapped only to Kibana, causing the problems.

Errors:

Sorry, there was an error

The file could not be processed due to error: "Unprocessable Entity: Document "db2785a5-a257-44bd-a7dd-bcfb9d7f5878" has property "dashboard" which belongs to a more recent version of OpenSearch Dashboards [7.17.3]. The last known version is [7.9.3]"

Could not find reference "panel_614fcb21-5773-4e0f-8ebc-e606a261ee2b"

Possible solutions: Maybe a bump to a higher Filebeat version would fix problem a) . Problem b) could require shipping different dashboards for both Kibana & OpenSearch Dashboards.

Your Environment

• Beat version (icingabeat -version): 7.17.4
• Icinga 2 version (icinga2 --version): 2.13.7+780.g2e4af46d4
• Elasticsearch version (curl -XGET 'localhost:9200'): 8.8.2
• Logstash version, if used (bin/logstash -V): 8.8.2 with OSS-Plugin
• Kibana version, if used (curl -XGET http://localhost:5601/status -I): 8.8.2
• OpenSearch version: 2.8
• OpenSearch Dashboards version: 2.8
• Operating System and version: RHEL 8.8 / Alma 8.8