Bug 2192955

Description of problem:

for Elasticsearch >= 7.3 and Opensearch >=2.0 the API has received significant changes. As consequence the RSYSLOG omelasticsearch-connector had to be updated, too. This happend at the middle of 2022, according to the statement of the main RSYSLOG developer: https://github.com/rsyslog/rsyslog/issues/4908#issuecomment-1164042133. I am not able to compare the package version of RSYSLOG included in the RHEL releases with the RSYSLOG version of the RSYSLOG main website, as RedHat uses a slightly different version name. As our company needs the new RSYSLOG connector (with RHEL 8.8) I would like to know for which RHEL version it is forseen to include a newer version of the RSYSLOG packages. Current available version on RSYSLOG website: 8.2302.0 (Feb. 2023). Current available on RHEL 9.1 iso: rsyslog-8.2102.0-105.el9. Current available on RHEL 8.7 iso: rsyslog-elasticsearch-8.2102.0-10.el8.x86_64.


Version-Release number of selected component (if applicable):

Rsyslog

How reproducible:

Always 

https://github.com/rsyslog/rsyslog/issues/4908


Steps to Reproduce:

Sample config with omelasticsearch,

    type="omelasticsearch"
    server=["localhost:9200"]
    usehttps="on"
    skipverifyhost="on"
    allowunsignedcerts="on"
    dynSearchIndex="on"
    searchIndex="special-index"

    searchType="_doc"

    bulkmode="on".




Actual results:

The log data cannot be sent to opensearch when bulkmode is turned on, with error messages like below,

{ "request": { "url": "https:\/\/localhost:9200\/_bulk", "postdata": "{\"index\":{\"_index\": \"special-2022.06.23\",\"_type\":\"_doc\"}}\n{\"time\":\"2022-06-23T16:25:36.266848+12:00\",\"timereceived\":\"2022-06-23T16:25:36.266848+12:00\",\"severity\":\"INFO\",\"tag\":\"systemd[1]\", \"msg\": \"Started System Logging Service.\", \"pname\": \"systemd\", \"host\": \"host123\", \"fromhost\": \"host123\", \"fac\": \"daemon\", \"pri\": \"30\" }\n\n" }, "reply": { "error": { "root_cause": [ { "type": "illegal_argument_exception", "reason": "Action\/metadata line [1] contains an unknown parameter [_type]" } ], "type": "illegal_argument_exception", "reason": "Action\/metadata line [1] contains an unknown parameter [_type]" }, "status": 400 } }


Expected results:

I use rsyslog omelasticsearch plugin to feed log to Opensearch 2.0. It works well when bulkmode is turned off. It's not practical to turn bulkmode off in production. So I expect it to work well when bulkmode is on.