Misleading type attribute in filebeat config

Elastic Stack Beats
1

Hi all

I've set up FileBeat with Logstash and followed the documentation here:
https://www.elastic.co/guide/en/beats/libbeat/master/configuration.html#configuration-output

The doc states do configure the following mapping:
index => "%{[@metadata][index]}"
document_type => "%{[@metadata][type]}"

But, the type is not the type you're used to with logstash-forwarder:
{
"paths": [ "/app/myapp/container/logs/localhost_access_log.*" ],
"fields": {
"type": "tomcat_access",
"environment": "INT",
"application": "myapp"
}

It's the type configured here:

  # Possible options are:
  # * log: Reads every line of the log file (default)
  # * stdin: Reads the standard in
  type: log

IMHO, the new type attribute introduced in filebeat should be renamed to something different.

Thanks
Oli

2

Related github PR: https://github.com/elastic/filebeat/pull/153

3

Now the documentation states:

"@metadata": {
  "beat": "<beat>",
  "type": "<event type>"
}

But with Beta 4 it's:

 "@metadata" => {
    "index" => "logstash-2015.11.02",
     "type" => "log"
}

Will the attribute "index" change to "beat" with RC/GA?

4

It will change with RC1 already

5

RC1 fixed the issue with document_type.

Thanks