Hi,
I am preparing my first elastic cluster for a pilot project. I was using the document-type attribute, but after the announcement that it will be gone, I am only using (explicitly) "_doc".
Since I am using templates, I was really defining the "_doc" in the template, but with the new attribute include_type_name=false, I just removed the type from the template.
My assumption is that I wouldn't have to ingest my documents using the document-type attribute as well (I'm using Logstash output to Elasticsearch), however if I do so, I get an error saying that there is a conflict, because the default document from Logstash seems to be "doc", and the index created from the template, creates as "_doc". Here is one error example:
[2019-04-03T09:44:07,416][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log_gen_test_2019.04.18", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x7179734d>], :response=>{"index"=>{"_index"=>"log_gen_test_2019.04.18", "_type"=>"doc", "_id"=>"SQZx42kB46xwkZUbSU9B", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [log_gen_test_2019.04.18] as the final mapping would have more than 1 type: [_doc, doc]"}}}}
My quesiton is. From version 7 (and on), is this the expected behavior? I mean, it seems that I have to define document_type => "_doc" in the Logstash output. That is the way to do? I am ok with that, but just need to make sure, trying to be compliant to Elasticsearch 7, minimizing the migration impact.
Thanks,
Rob