Type vs Tags?


(Elvar) #1

Some time ago type was declared to being depreciated in Logstash and that we should be using tags instead. Ever since then I have migrated everything to tags, and that is fine. I know that in Elasticsearch type has a meaning and after reading this blog about it https://www.elastic.co/blog/index-vs-type I'm even more confused when it comes to incoming logs.

Obviously logs should for the most part be stored in the same daily index, but then what about types or logs, do we gain anything when using type?


(Magnus Bäck) #2

Some time ago type was declared to being depreciated in Logstash and that we should be using tags instead.

What's deprecated is using

some-filter {
  ...
  type => "foo"
}

instead of

if [type] == "foo" {
  some-filter {
    ...
  }
}

but setting the type field in e.g. the input and using it in subsequent conditionals etc is _not_deprecated.


(Elvar) #3

That actually make a whole lot of sense now.

Since type matters in Elasticsearch, should I start to use type again?


(Magnus Bäck) #4

Yes, I think using the type to differentiate between different kinds of messages is a good idea.


(Elvar) #5

I'm already using tags for that, so do I gain anything when using type?


(system) #6