I have Logstash running version 7.4.0. It is connecting to an Elasticsearch cluster running 7.4.0. I am not sure why the following issue is showing up.
[2019-11-03T05:34:11,762][WARN ][logstash.outputs.elasticsearch] You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch bulk_path=>"/_monitoring/bulk?system_id=logstash&system_api_version=7&interval=1s", ssl_certificate_verification=>false, password=><password>, hosts=>[https://coord01.mypod.mydomain:9411, https://coord02.mypod.mydomain:9411, https://coord03.mypod.mydomain:9411], cacert=>"/etc/pki/tls/CA/snc.ca.crt", sniffing=>false, manage_template=>false, id=>"721b6fcb8b386c18c9166d6ce14aeb62e6271b2a16677e17796012cf0e0eafcc", user=>"logstash_system", ssl=>true, document_type=>"%{[@metadata][document_type]}", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_4c3c940c-5d20-49d2-8ea1-948c625055ea", enable_metric=>true, charset=>"UTF-8">, workers=>1, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, ilm_enabled=>"auto", ilm_rollover_alias=>"logstash", ilm_pattern=>"{now/d}-000001", ilm_policy=>"logstash-policy", action=>"index", sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}
One suspicion is that the template for monitoring indices was somehow not updated when the new RPM was installed. Please let me know how that can be verified. Also, let me know if there are any other suggestions for the issue,