I'm trying to prepare for the eventual deprecation of document types in Elasticsearch, and it's not easy to nail down all conflicts. One that I'm blinking at at the moment is [ 'doc', '_doc' ] ...
The Elasticsearch documentation about removal of types says that
The preferred type name is
_doc
, so that index APIs have the same path as they will have in 7.0:PUT {index}/_doc/{id}
andPOST {index}/_doc
On the other hand, the Logstash 6.3 Breaking Changes notes say
The default document_type has changed from logs to doc for consistency with Beats.
Sounds like the "consistency" should be driving in the other direction. Shouldn't both Logstash and Beats start to use _doc
? What is going to be best practice here?