the _default_ mapping type is deprecated and will be removed in 7.x
the preferred type name is _doc
Given the above, I am in the process of changing the templates. However, I noticed that when Logstash sends data to Elasticsearch, the type is doc and not _doc by default (I did not set any specific type in logstash.conf).
I verified that the type in my index is of type doc because GET {index}/_doc/{id} does not work and this GET {index}/doc/{id} works.
So I assuming, in my templates I should define the mapping for doc type and not _doc even though in the above documentation the recommended type is _doc?
If suddenly the stack switches from doc to _doc, I think it might cause some problems, because:
I used to use _default_ in templates which basically applies the mappings regardless of type.
Now, I am switching to doc because that is what stuff from Logstash is mapped to.
In the future, Logstash switches to _doc cos the stack switched to _doc and suddenly my mappings which are defined only for doc type stop being applied .
Is what I'm thinking above possible?
If it is possible, does that mean to prevent the above problem from happening, I should define two exactly the same set of mappings one for _doc and one for doc - basically in anticipation of the stack switch from doc to _doc?
So if I understood the github issue correctly then _doc will be used going forward for Logstash.
So unless I change my logstash.conf to explicitly set documents sent by Logstash to retain the old type doc, it will be changed to _doc. Therefore, I will now have old indexes with type doc and new indexes with type _doc which might or might not cause some subsequent problems.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.