# Deprecated document\_type in Logstash 6

**URL:** <https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814>\
**Category:** Logstash\
**Created:** [November 15, 2017, 7:27pm UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814 "2017-11-15T19:27:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [November 15, 2017, 7:27pm UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814/1 "2017-11-15T19:27:41Z")

</div>

Hello,  
See in the breaking Changes ([Breaking changes | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/breaking-changes.html)) that:

> "The default document\_type has changed from logs to doc for consistency with Beats"

What does this mean for me?

I am using this output like this:  
elasticsearch {  
hosts =\> "elasticsearchserver:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}

Does this just mean that the type property will be removed from documents?  
If i dont use that, can i remove that row?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 17, 2017, 6:44am UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814/2 "2017-11-17T06:44:32Z")

</div>

Have a look at [Help please.. breaking changes?](https://discuss.elastic.co/t/help-please-breaking-changes/108010/)

---

<div class="post-metadata">

**Author:** ![Maekee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maekee/32/21708_2.png) [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Post date:** [November 17, 2017, 12:20pm UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814/3 "2017-11-17T12:20:04Z")

</div>

That is Another thread i created, the problem was that i had not uploaded a new beat template into elasticsearch. Now i have uploaded the template and i dont see any errors, but i see this in my logstash log:

> [2017-11-17T11:11:07,182][WARN][logstash.outputs.elasticsearch] You are using a deprecated config setting "document\_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=\>"document\_type", :plugin=\>\<LogStash::Outputs::Elasticsearch hosts=\>"vascmdbtest01:9200", manage\_template=\>"false", index=\>"%{[@metadata][beat]}-%{[@metadata][version]}-dc-%{+YYYY.MM.dd}", document\_type=\>"%{[@metadata][type]}", id=\>"6f734d37a3f67008eddcd9167d4a741ea61831ed43f9528428cbb1c915e8ebaf"\>}

if i remove the following line from the logstash output block to elasticsearch:  
document\_type =\> "%{[@metadata][type]}"

I get these warnings:  
[2017-11-17T13:18:20,163][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"winlogbeat-6.0.0-2017.11.17", :\_type=\>"wineventlog", :\_routing=\>nil}, #LogStash::Event:0x2b15d6c6], :response=\>{"index"=\>{"\_index"=\>"winlogbeat-6.0.0-2017.11.17", "\_type"=\>"wineventlog", "\_id"=\>"0OnqyV8BA5Maqd7NWlSX", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Rejecting mapping update to [winlogbeat-6.0.0-2017.11.17] as the final mapping would have more than 1 type: [doc, wineventlog]"}}}}

Why? How do i get away from using document\_type?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 17, 2017, 8:00pm UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814/4 "2017-11-17T20:00:49Z")

</div>

Ok, let me close this one in favour of that given there is more activity there 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 17, 2017, 8:00pm UTC](https://discuss.elastic.co/t/deprecated-document-type-in-logstash-6/107814/5 "2017-11-17T20:00:52Z")

</div>