I've upgraded without too much hassle from ELK 5.5 across 6.8 to 7.3.
Arriving at 7.3 I notice that the index in ES that LS seems to use is "logstash". Why? Why won't it continue writing to the existing logstash- (in this case logstash-2019.09.02)
AFAICS the default "index" directive of LS output module "elasticsearch" has not changed and apart for which ES host it should log to, nothing is configured.
Why is it doing this?
UPDATE Oh well I guess it's not a problem with ES since I've captured the HTTP stream and the POST request to "/_bulk" says: