Document_type deprecated?

Elastic Stack Beats
2

I think that you will need to declare document_type as a custom field under fields, this way the type field will take the place of the _type field, as stated on this link.

I use the type field to allow me filter to in logstash, to use it with Filebeat 5.5 I've just declared it as a custom field under fields, as the example bellow

filebeat:
 prospectors:
  - input_type: log
    paths:
     - C:\inetpub\logs\LogFiles\W3SVC1\*.log
    fields:
      document_type: my-type
    exclude_lines: ["^#"]
    exclude_files: [".zip"]
    fields_under_root: true
    ignore_older: 24h
1 Like