Remove Filebeat compatibility setting from opensearch.yml

[AlexRuiz7]

Description

Filebeat won't be used on Wazuh 5. There is a compatibility setting in opensearch.yml to allow Filebeat to connect to the Indexer. We need to remove this line from the configuration file.

### Option to allow Filebeat-oss 7.10.2 to work ###
compatibility.override_main_response_version: true

Plan

• Research about this setting and extract any side effect of its removal.
• Identify potential propagation to other components (search for this setting in other repositories of Wazuh).
• Finally, remove the setting from our opensearch.prod.yml file.

[mcasas993]

Results of research about this setting and extract any side effect of its removal

OpenSearch tools

Agents and ingestion tools

Historically, many multiple popular agents and ingestion tools have worked with Elasticsearch OSS, such as Beats, Logstash, Fluentd, FluentBit, and OpenTelemetry. OpenSearch aims to continue to support a broad set of agents and ingestion tools, but not all have been tested or have explicitly added OpenSearch compatibility.

As an intermediate compatibility solution, OpenSearch has a setting that instructs the cluster to return version 7.10.2 rather than its actual version.

So you can maintain the compatibility adding this setting:

PUT _cluster/settings
{
  "persistent": {
    "compatibility": {
      "override_main_response_version": true
    }
  }
}

Migrating from Elasticsearch OSS to OpenSearch

Cluster with legacy clients

If you're actively connecting to the cluster with legacy clients that check for a particular version number, such as Logstash OSS, add a compatibility setting to opensearch.yml:
compatibility.override_main_response_version: true

Other compatibilities

Zammad

When someone ask for the compatibility of Zammad with OpenSearch they responded that using
compatibility.override_main_response_version: true
opensearch configuration setting works.