# Unkown Key in Elasticsearch Template (elastic stack 8.3.3) **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-monitoring, filebeat\ **Created:** [July 11, 2023, 11:56am UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100 "2023-07-11T11:56:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ARm1110](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arm1110/32/123279_2.png) [@ARm1110](https://discuss.elastic.co/u/ARm1110)\ **Post date:** [July 11, 2023, 11:56am UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/1 "2023-07-11T11:56:53Z")
elastic stack(filebeat,elasticsearch,kibana,elastic-agent,logstash) =\> 8.3.3 OS: Ubuntu 22.04 Agents: linux base I wanted to run Wazuh manager with Elastic 8.3.3, the Wazuh plugin can't be installed with elastic, I made custom changes in the filebeat configuration file, everything is ok, but I can't see any data in the Discover section, and I see an error in the filebeat log. my wazuh manager is seed log and status is runing command: filebeat setup ```auto // filebeat log Exiting: error loading template: failed to load template: couldn't load template: 400 Bad Request: {"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [order]"}],"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [order]"},"status":400}. Response body: {"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [order]"}],"type":"x_content_parse_exception","reason":"[1:2] [index_template] unknown field [order]"},"status":400} // end log ``` filebeat config : ```auto output.elasticsearch: hosts: ["172.16.103.74:9200"] username: "beats_system" password: "Jzbi95h7Vp7FTd%" protocol: https ssl.verification_mode: certificate ssl.certificate_authorities: /etc/logstash/certs/ca_1685533466292.crt filebeat.modules: - module: wazuh alerts: enabled: true archives: enabled: false setup.template.json.enabled: true setup.template.json.path: /etc/filebeat/wazuh-template.json setup.template.json.name: wazuh setup.template.overwrite: true setup.ilm.enabled: false logging.metrics.enabled: false logging.level: debug seccomp: default_action: allow syscalls: - action: allow names: - rseq ``` \*\* wazuh-template.json\*\* ```auto { "order": 0, "index_patterns": [ "wazuh-alerts-4.x-*", "wazuh-archives-4.x-*" ], "settings": { "index.refresh_interval": "5s", "index.number_of_shards": "3", "index.number_of_replicas": "0", "index.auto_expand_replicas": "0-1", "index.mapping.total_fields.limit": 10000, "index.query.default_field": [ * * * * "version": 1 } ``` filebeat test output ```auto elasticsearch: https://172.16.103.74:9200... parse url... OK connection... parse host... OK dns lookup... OK addresses: 172.16.103.74 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.3 dial up... OK talk to server... OK version: 8.3.3 ``` but not receive wazuh log just get filebeat log ![Capture2](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90b58b251503672d9ea1a65dc24aba8ca61c8d24.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 11, 2023, 12:35pm UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/2 "2023-07-11T12:35:22Z")
Hello, Wazuh is a third-party tool and it is not supported here, any issue with templates from wazuh you need to check with the Wazuh community. But from what you shared, this template is using the legacy format that used the `_template` endpoint, which is deprecated, and if I'm not wrong filebeat will use the `_index_template` endpoint. You will need to load your template manually and not using filebeat. > [@ARm1110](#): > > but not receive wazuh log just get filebeat log You are receiving the Wazuh logs, the `full_log` field comes from Wazuh, you are just not parsing it, you will need to load the Wazuh ingest pipeline manually as well. But as I said, you need to check with the Wazuh community. ---
**Author:** ![ARm1110](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arm1110/32/123279_2.png) [@ARm1110](https://discuss.elastic.co/u/ARm1110)\ **Post date:** [July 15, 2023, 5:41am UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/3 "2023-07-15T05:41:49Z")
Hello, I wanted to combine the ansible tool with elastic security, is it possible? is hard ? and not use wazuh . ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 15, 2023, 1:35pm UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/4 "2023-07-15T13:35:02Z")
> [@ARm1110](#): > > Hello, I wanted to combine the ansible tool with elastic security, is it possible? is hard ? > and not use wazuh . It is not clear what you mean or what you want to do, ansible is an automation tool, it has nothing to do with Wazuh or Elastic Security. Can you provide more context? ---
**Author:** ![ARm1110](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arm1110/32/123279_2.png) [@ARm1110](https://discuss.elastic.co/u/ARm1110)\ **Post date:** [July 16, 2023, 4:41am UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/5 "2023-07-16T04:41:16Z")
My problem was solved. I changed the version to 7.17 elastic security and installed the wazuh plugin. **Thank you for your guidance** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 13, 2023, 6:41am UTC](https://discuss.elastic.co/t/unkown-key-in-elasticsearch-template-elastic-stack-8-3-3/338100/6 "2023-08-13T06:41:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.