# How to change the default type "doc" for fileBeat index when ingest data to ES by ingest?

**URL:** <https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 20, 2018, 2:24pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786 "2018-03-20T14:24:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jackyshen](https://avatars.discourse-cdn.com/v4/letter/j/85f322/32.png) [@jackyshen](https://discuss.elastic.co/u/jackyshen)\
**Post date:** [March 20, 2018, 2:24pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786/1 "2018-03-20T14:24:18Z")

</div>

I set the prospectors to ingest Nginx log to ES by fileBeat 5.5.0, and I found the type is "\_type": "doc". I want to change the type name doc to other name, how to do it ?

```auto
**My config :**
filebeat.prospectors:

- type: log

  enabled: true

  paths:
    #- /var/log/*.log
    # 
    - D:\nginx-1.13.8\logs\access.log
    #- c:\programdata\elasticsearch\logs\*
    

**The indexed document in the ES.**
{
  "_index": "filebeat-2018.03.20",
  "_type": **"doc",**
  "_id": "P7-2Q2IBoQbqqlRr8Tx9",
  "_version": 1,
  "_score": 1,
  "_source": {
    "@timestamp": "2018-03-20T14:01:20.288Z",
    "beat": {
      "hostname": "HQ-PAB41656",
      "name": "HQ-PAB41656",
      "version": "5.5.0"
    },
    "input_type": "log",
    "message": "2018/03/20 22:01:11 [error] 7628#11008: *71 CreateFile() \"D:\\nginx-1.13.8/html/gggg\" failed (2: The system cannot find the file specified), client: 127.0.0.1, server: localhost, request: \"GET /gggg HTTP/1.1\", host: \"localhost:808\"",
    "offset": 35280,
    "source": "D:\\nginx-1.13.8\\logs\\error.log",
    "type": "log"
  },
  "fields": {
    "@timestamp": [
      "2018-03-20T14:01:20.288Z"
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 22, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786/2 "2018-03-22T11:56:50Z")

</div>

Mapping types are being removed from Elasticsearch and Filebeat doesn't allow the `_type` value to be configured to ensure there's only a single `_type` value. You can still customize the `type` value with `fields: {type: foo}` and `fields_under_root: true` in Filebeat

- [ES - Removal of Mapping Types](https://www.elastic.co/guide/en/elasticsearch/reference/current/removal-of-types.html)

---

<div class="post-metadata">

**Author:** ![jackyshen](https://avatars.discourse-cdn.com/v4/letter/j/85f322/32.png) [@jackyshen](https://discuss.elastic.co/u/jackyshen)\
**Post date:** [March 22, 2018, 4:04pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786/3 "2018-03-22T16:04:06Z")

</div>

From the url "ES - Removal of Mapping Types" you provided, it says the alternative is "Index per document type", suppose I have two types of log files ,one is type access.log , another is error.log, and I want to put them into different index ,such as access.log into index1 and error.log into index2 , how to configure it in ElasticSearch output of filebeat.yml( version 5.5 )? As I notice that I Just only can set one index name in the Elastic Search output.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 22, 2018, 4:33pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786/4 "2018-03-22T16:33:12Z")

</div>

You can use the [`indices`](https://www.elastic.co/guide/en/beats/filebeat/5.5/elasticsearch-output.html#_indices) configuration option to have it write documents to different indices.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2018, 4:33pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786/5 "2018-04-19T16:33:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.