Use _doc instead of doc type mapping to match ES convention and to be forward compatible when types are removed.
Tested and it works. If you have already used makelogs to create logstash-* previously, and do not allow makelogs to replace the indices/index templates, there will be an error about multiple mappings: Rejecting mapping update to [logstash-0] as the final mapping would have more than 1 type: [doc, _doc]
Easiest solution is to just let makelogs replace the indices and corresponding templates.
Use
_doc
instead ofdoc
type mapping to match ES convention and to be forward compatible when types are removed.Tested and it works. If you have already used
makelogs
to createlogstash-*
previously, and do not allow makelogs to replace the indices/index templates, there will be an error about multiple mappings:Rejecting mapping update to [logstash-0] as the final mapping would have more than 1 type: [doc, _doc]
Easiest solution is to just let makelogs replace the indices and corresponding templates.