Make configuration only take effect for next daily index

Elastic Stack Logstash
1

Hi,

We index into daily indices from logstash e.g. my_index-%{+YYYY.MM.dd}. I would like to adjust the value of a setting on the elasticsearch output, but I only want that setting to take effect for the next day's index (not the current one). What is the best approach here?

Thanks.

2

What setting are you changing?

3

Hi Christian,

I want to change document_type.

4

Hmm, thinking about this some more... it's possible I may not need to do this.

I'm planning to upgrade the cluster from 6.8 to 7.4 (logstash is 6.8 too and we will upgrade that afterwards). I'm concerned that once the cluster is upgraded, logstash will start sending _doc where it was previously sending doc and elasticsearch will reject the documents as multiple document types aren't allowed. However, from what I gather, _doc is an endpoint rather than a document type, so when logstash tries to index documents to an index with a doc mapping type in elasticsearch 7, I should actually be fine, right?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.