"flattened" type with OpenDistro

we tried to install OpenDistro while preserving the data of our non-OSS Elasticsearch single-node system.

Unfortunately roughly half of our indices are in a “red” state, because Elasticsearch-OSS does not understand the “flattened” Type:
org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: No handler for type [flattened] declared on field [local_metadata]

The affected indices are created by Kibana and Filebeat, but we would like to keep the Kibana configuration and filebeat logs.

Is there any way to preserve existing data from a non-OSS Elasticsearch (with indices with “flattened” type) and still use OpenDistro?
Or do we have to convert/delete those fields?
If we have to convert, what is best-practice do achieve this?

Thanks a lot and best regards

hey ssc!

The flattened field type is a proprietary / x-pack feature, so it’s not supported by open distro. WRT Filebeat, there are two distinct versions - one is open source and compatible with Open Distro - IIRC, it won’t have any incompatible data types.