#1013464 rsyslog omelasticsearch plugin unable to talk to opensearch 2.0 with bulkmode on

Package:
rsyslog
Source:
rsyslog
Description:
reliable system and kernel logging daemon
Submitter:
David Williams
Date:
2022-06-27 12:18:03 UTC
Severity:
normal
#1013464#5
Date:
2022-06-24 06:18:49 UTC
From:
To:
Dear Maintainer,

I use rsyslog omelasticsearch plugin to feed logs to Opensearch 2.0. It works well when bulkmode is turned off. But it throws errors when bulkmode is on, with example below,

{ "request": { "url": "https:\/\/localhost:9200\/_bulk", "postdata": "{\"index\":{\"_index\": \"special-2022.06.23\",\"_type\":\"_doc\"}}\n{\"time\":\"2022-06-23T16:25:36.266848+12:00\",\"timereceived\":\"2022-06-23T16:25:36.266848+12:00\",\"severity\":\"INFO\",\"tag\":\"systemd[1]\", \"msg\": \"Started System Logging Service.\", \"pname\": \"systemd\", \"host\": \"host123\", \"fromhost\": \"host123\", \"fac\": \"daemon\", \"pri\": \"30\" }\n\n" }, "reply": { "error": { "root_cause": [ { "type": "illegal_argument_exception", "reason": "Action\/metadata line [1] contains an unknown parameter [_type]" } ], "type": "illegal_argument_exception", "reason": "Action\/metadata line [1] contains an unknown parameter [_type]" }, "status": 400 } }

I have reported this problem upstream, see bug report in https://github.com/rsyslog/rsyslog/issues/4908

What I have observed so far is the latest rsyslog v8.2206.0 has fixed this problem. Is there a plan to make this version available soon to Debian stable or backport?
#1013464#10
Date:
2022-06-24 06:49:44 UTC
From:
To:
Am 24.06.22 um 08:18 schrieb David Williams:

Marking as fixed for that version.

Sure, I'll update the backport accordingly.
#1013464#15
Date:
2022-06-24 06:53:25 UTC
From:
To:
Am 24.06.22 um 08:18 schrieb David Williams:

Fwiw, I wonder if that is related to the switch from GnuTLS to OpenSSL
in 8.2206.0-1

https://salsa.debian.org/debian/rsyslog/-/commit/3ff8b32d54050571bf70d6848e10c825289d6c27


I'll keep this change for the backport as well.

Regards,
Michael
#1013464#20
Date:
2022-06-27 10:10:37 UTC
From:
To:
Am 24.06.22 um 08:18 schrieb David Williams:

The upload to bullseye-backports has happened in the mean time and
should be available to you by now.

Regards,
Michael
#1013464#25
Date:
2022-06-27 12:15:22 UTC
From:
To:
Hi Michael,

Thank you for your quick response. You have really made things a lot simpler for us!

All the best,

David

Am 24.06.22 um 08:18 schrieb David Williams:

The upload to bullseye-backports has happened in the mean time and should be available to you by now.

Regards,
Michael