# Failure to replace elastic search document\_type using logstash config
**URL:** https://discuss.elastic.co/t/failure-to-replace-elastic-search-document-type-using-logstash-config/85255
**Category:** Logstash
**Created:** [May 10, 2017, 1:38pm UTC](https://discuss.elastic.co/t/failure-to-replace-elastic-search-document-type-using-logstash-config/85255 "2017-05-10T13:38:27Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@cganesan](https://discuss.elastic.co/u/cganesan)
#### Post date: [May 10, 2017, 1:38pm UTC](https://discuss.elastic.co/t/failure-to-replace-elastic-search-document-type-using-logstash-config/85255/1 "2017-05-10T13:38:27Z")
I'd like elastic search to dynamically create different document\_types based on input json variable property in the config. For quite some time I've been struggling to get logstash replace the elastic search document\_type field with the JSON property. As this is a common feature in logstash appreciate your help with identifying what I'm doing wrong with my configuration. I can see each of the input json show up in elastic search index however the document\_type shows up as %{testid} instead of "abc123"
My conf files are: (logstash filebeat config)
input {
beats {
port =\> 5044
type =\> "json"
ssl =\> false
}
}
filter {
json {
source =\> "message"
}
}
output {
elasticsearch {
hosts =\> ["192.168.99.103:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "logs"
document\_type =\> "%{testid}"
}
}
filebeat.yml (snippet)
document\_type: json
json.message\_key: log
The input jso
{ "URI": "[http://test.com/test](http://test.com/test)", "file": "testgo:1475", "level": "warn", "method": "GET", "msg": "just a test", "package": "test", "payload": "", "time": "2017-04-05T01:10:50.175580776Z", "testid": "abc123", "someid": "1234", "creationdt": "2017-04-06" }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 14, 2017, 8:31pm UTC](https://discuss.elastic.co/t/failure-to-replace-elastic-search-document-type-using-logstash-config/85255/2 "2017-05-14T20:31:50Z")
Please show an example of what an event stored in Elasticsearch looks like. Copy/paste from Kibana's JSON tab (in the Discover panel) or us a `stdout { codec => rubydebug }` output in Logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2017, 8:41pm UTC](https://discuss.elastic.co/t/failure-to-replace-elastic-search-document-type-using-logstash-config/85255/3 "2017-06-11T20:41:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.