Beats can't to write to older versions of ES than 6.2 due to _doc

[henrikno]

I tried to point filebeat master at a 5.6.14 ES cluster and it fails with:

{"type":"invalid_type_name_exception","reason":"Document mapping type name can't start with '_', f ound: [_doc]"}

It will be the same for ES <6.2 since support for _doc was added to 6.2: elastic/elasticsearch#27816

According to the PR switching to _doc it should only do so for ES 7.0 #9056
But it looks like it's hard coded:

beats/libbeat/outputs/codec/json/event.go

Line 49 in 41f87a4

Type: "_doc",

Shouldn't this use eventType?

beats/libbeat/outputs/elasticsearch/client.go

Lines 693 to 697 in 41f87a4

	if client.GetVersion().Major < 7 {
	client.eventType = defaultEventTypeES6
	} else {
	client.eventType = defaultEventType
	}

[urso]

This should work now with recent master.

[ph]

This should be fixed in latest releases.