Hmm, thinking about this some more... it's possible I may not need to do this.
I'm planning to upgrade the cluster from 6.8 to 7.4 (logstash is 6.8 too and we will upgrade that afterwards). I'm concerned that once the cluster is upgraded, logstash will start sending
_doc where it was previously sending
doc and elasticsearch will reject the documents as multiple document types aren't allowed. However, from what I gather,
_doc is an endpoint rather than a document type, so when logstash tries to index documents to an index with a
doc mapping type in elasticsearch 7, I should actually be fine, right?