Is @version filed created by Elasticsearch or Logstash?

Elastic Stack Elasticsearch
1

Hello all,

I'm trying to fix as many issues I can in my Elastic Stack setup before upgrading to version 6. One thing I would like to sort out are conflicting Index Patterns.

In one of my clusters I have a conflict for @version where both string and number are used. In my production cluster there is no conflict and the type is string which I find a bit surprising...

Anyway, I use Elastic Stack for classic log shipping and analysing. Version 5.6.5 if that makes a difference.

  1. First off I'd like to know where the @version field comes from. Is it aded by Elasticsearch or some other part of the stack, like Logstash?

  2. Specific log documents are not updated and thus not versioned so I don't see how I would ever have any use of the @version filed. Is it possible to drop that field somehow?

All suggestions and comments are welcome :slight_smile:

Cheers,
AB

2

It's a Logstash thing. You can drop if it you want, yes.

3

Hi @warkolm,
thanks for the info :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.