Ealsticsearch doucment_type

[tishion (Sheen Tian)]

document_type
edit

Value type is string
There is no default value for this setting.
This option is deprecated 

Note: This option is deprecated due to the removal of types in Logstash 6.0. It will be removed in the next major version of Logstash. This sets the document type to write events to. Generally you should try to write only similar events to the same type. String expansion %{foo} works here. If you don’t set a value for this option:

**for elasticsearch clusters 6.x and above: the value of doc will be used;**

** for elasticsearch clusters 5.x and below: the event’s type field will be used, if the field is not present the value of doc will be used.**

i have two questions:

1. In our cluster, we removed the document_type from the output config and then it just use the value of [type] as the doc type to index the event. The cluster are all in version 6.0.0 and this is different with the document.

2. In our elasticsearch cluster we have customized doc type instead of 'doc', so how can we use the elasticsearch output to index the event to our ES since it is not configurable in the output plugin according to the document ?

[warkolm (Mark Walkom)]

1. That's not a question
2. Do you have multiple _types in the index?

[tishion (Sheen Tian)]

Sorry for missing the question..

1. in the document

for elasticsearch clusters 6.x and above: the value of doc will be used

but in our real environment, it uses the value of [type], not 'doc'
Does this mean in version 6.0.0 or above we can use [type] as the desired document type name?

2. We don't have multiple _types in the index (I hope you are asking doc type.) In our cluster, we have 1 doc type for 1 index, but we named the doc type with meaningful name rather than 'doc' by mapping in template.

And i can make my question simpler:

How to change document type name in Elasticsearch output plugin for Elasticsearch of version 6.0.0 or above?

[warkolm (Mark Walkom)]

@tishion

Does this mean in version 6.0.0 or above we can use [type] as the desired document type name?

Not in the same index.

@tishion

We don't have multiple _types in the index (I hope you are asking doc type.) In our cluster, we have 1 doc type for 1 index, but we named the doc type with meaningful name rather than 'doc' by mapping in template.

That's fine. You can use something that isn't doc, we just picked that as a default term to get users used to only having a single type.

@tishion

How to change document type name in Elasticsearch output plugin for Elasticsearch of version 6.0.0 or above?

You can continue to use document_type for 6.X.

[tishion (Sheen Tian)]

You can continue to use document_type for 6.X.

Hi @warkolm Thanks for your quick reply. We know we can use the document type now, but we want to fix the problem at one time. it works in 6.X but we don't want to change it again in 7.X .

[warkolm (Mark Walkom)]

Then use the default of doc and create your own custom type field.