Hm.... checking the 5.5 branch I clearly see _type
being hardcoded to docs
.
The _type
field is set here: https://github.com/elastic/beats/blob/5.5/libbeat/outputs/elasticsearch/client.go#L325
with eventType
being hardcoded to "doc"
: https://github.com/elastic/beats/blob/5.5/libbeat/outputs/elasticsearch/client.go#L96
Are you using the Elasticsearch output or Logstash?