Hi @warkolm ,
Users have readonly priviliges to problematic index. The filebeat can write to this index only and I've to find out what happend. I try to explain what cause document _version update in my case. How to analyze and monitor such cases?
Best Regards,
Dan