Since 6.0 we have been using the mapping/_type of
doc in all our ES Indices. As we have now upgraded to 6.5 we want to migrate to the (almost official)
_doc mapping type.
We tried this by creating a new index with the
_doc mapping, reindexing (specifying
_doc) and deleting the old index (alias etc.).
The problem is now that we are unable to index any documents. The error is:
Rejecting mapping update to [myindex-dev2] as the final mapping would have more than 1 type: [_doc, doc]
We have checked all our settings (filebeat, logstash and elasticsearch) and nowhere do we specify the _type.
If we add
document_type => "_doc" to our elasticsearch output config in logstash it solves the problem.
Why does Logstash assume "doc" unless we specify "_doc"?? We are on ELK 6.5
PS: When we upgrade we always maintain our config/ and data/ folders, deleting the ones delivered with ElasticSearch, Logstash and FileBeat.