Hi, I created a pipeline in logstash, and and an index in elasticsearch. I am importing data from couch db. Yet the documents I retrieve are wrapped in an additional field "doc" (within "_source" that I don't want):
"hits" : [
{
"_index" : "my_index",
"_type" : "_doc",
"_id" : "some id",
"_score" : 1.0,
"_source" : {
"doc" : {
"x":"some value",
//other fields and values
}
}
}
}
]
How is this "doc" even inserted into my_index if it is not defined there?
This is the beginning of my index mapping definition:
{
"wsa_profiles_db_index" : {
"aliases" : { },
"mappings" : {
"dynamic" : "false",
"properties" : {
"x" : {
"properties" : {
"x1" : {
//and it continues
My output elasticsearch plugin in logstash is as follows:
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "my_index"
document_id => "%{[@metadata][_id]}"
action => "update"
doc_as_upsert => "true"
}
In the filter{} clause I only remove fields so I do not add any "doc" field.
And in couchdb I do not embed anything into this "doc " field.
How to get rid of "doc"-embedding?
Could you please help? I am new to ELK. I would greatly appreciate that 