# Confusions around ELK6 types

**URL:** https://discuss.elastic.co/t/confusions-around-elk6-types/124008
**Category:** Elasticsearch
**Created:** [March 14, 2018, 11:37pm UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008 "2018-03-14T23:37:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Krzysztof\_Szarlej](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Krzysztof\_Szarlej](https://discuss.elastic.co/u/Krzysztof_Szarlej)
#### Post date: [March 14, 2018, 11:37pm UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/1 "2018-03-14T23:37:04Z")

</div>

Hi guys,

I am totally confused about document types in new ELK.

I am now migrating from v5 to v6. When reading the Elasticsearch guide on getting rid of types ([https://www.elastic.co/guide/en/elasticsearch/reference/master/removal-of-types.html#\_custom\_type\_field](https://www.elastic.co/guide/en/elasticsearch/reference/master/removal-of-types.html#_custom_type_field)) it says that it is best to use "\_doc" mapping name as the only mapping type in index templates. Fair enough.

Now, beats are assuming that default event type is always "doc" - [Document\_type deprecated?](https://discuss.elastic.co/t/document-type-deprecated/96441/6)

Also when reading logstash documentation [https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html](https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html) it mentions that to fix issue with multiple types one can set document\_type =\> doc (and not \_doc) even though it is actually deprecated.

What is true then? Should we use doc? or maybe \_doc?  
Best Regards

When reading

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 14, 2018, 11:55pm UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/2 "2018-03-14T23:55:49Z")

</div>

We’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! 😉 Check out [https://www.elastic.co/elk-stack](https://www.elastic.co/elk-stack)

In regards to your question though, both Logstash and Filebeat use `doc`. You are right about Elasticsearch being different though, I will raise that internally.

Whatever you choose though, it just needs to be the same if you have different sources going into the one index.

---

<div class="post-metadata">

### Author: ![Krzysztof\_Szarlej](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Krzysztof\_Szarlej](https://discuss.elastic.co/u/Krzysztof_Szarlej)
#### Post date: [March 15, 2018, 12:27am UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/3 "2018-03-15T00:27:52Z")

</div>

Thanks for quick reply,

IMO it is actually major problem.

When using available [elastic.co](http://elastic.co) docs on migration from 5x to 6x people will end up with documents not being indexed.

1. According to the docs they will create \_doc mappign type name so it will be good when 7.0 is released
2. Then they will remove document\_type settings from logstash(cause it is deprecated).
3. They will end up with error `the final mapping would have more than 1 type: [_doc, doc]` because logstash will set `doc` and elasticsearch based on mapping will set `_doc`.

Or maybe I am doing something wrong 😛 - but thats what happened to me

---

<div class="post-metadata">

### Author: ![gfigoni](https://avatars.discourse-cdn.com/v4/letter/g/8c91f0/32.png) [@gfigoni](https://discuss.elastic.co/u/gfigoni)
#### Post date: [March 16, 2018, 6:10am UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/4 "2018-03-16T06:10:51Z")

</div>

Same here : I had to redo all my template mappings to change type from "\_doc" to "doc" because of Logstash behavior.

Note that this has already been reported here a month ago : [Default value of the type field](https://discuss.elastic.co/t/default-value-of-the-type-field/119280/2)

---

<div class="post-metadata">

### Author: ![Krzysztof\_Szarlej](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Krzysztof\_Szarlej](https://discuss.elastic.co/u/Krzysztof_Szarlej)
#### Post date: [March 16, 2018, 4:13pm UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/5 "2018-03-16T16:13:24Z")

</div>

Seems like elastic team also got lost in all this `document_type` changes 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2018, 4:13pm UTC](https://discuss.elastic.co/t/confusions-around-elk6-types/124008/6 "2018-04-13T16:13:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
