Document_type deprecated elasticsearch output logstash

Elastic Stack Logstash
1

Hello guys,

I'm using logstash 6.1.0.

The output section is configured for ElasticSearch as following:

output {
elasticsearch {
hosts => "http://localhost:9200"
index => "Data"
document_type => "MyType"
}
stdout { codec => rubydebug }
}

I see in logstash that document_type is deprecated.
When removed, the document type used is doc.
What should I do in this case. I tried type => "MyType" but seems not working

Regards
Driss

2

Document type is deprecated but not completely removed. It will be removed in the next release.
There is no issue with your current configuration.
https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html

Regards,
N

3

With *beat, try this.

fields_under_root: true
  fields:
    type: your_type
4

@tatdat : Hello,
Didn't understand your answer.

5

You can use that config above in beat (filbeat, winlogbeat ....) instead of document_type => "MyType"

6

For any new indices created in Elasticsearch 6.x, only one type is allowed per index, which means that you can not use it to differential different types of data (although you could store the type in a normal field instead and filter on this if needed). I therefore do not see the reason why you need to set the type instead of using the default value 'doc'.

1 Like
7

Thank you for you answer Christian.
I have already loaded some data in ES using DevTools. The type created had a business name.

Also I wanted to have data from Logstash as before without any new changes (it's why i added remove_fields and document_type).
How upward compatibility be satisfied if you remove that field?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.