Logstash configuration for new Version 6.5.4

Yes, it is deprecated, but it still has a use, which is to force the document type to something other than doc. If you want to continue writing document to an index that already contains documents of type messages then you have to use it. As I said, you really need to remove document_type at the same time that you roll over to a new daily index.