Docs cleanup for ES 6.0 doctype changes

[acchen97]

There's a few other doc areas that could warrant a minor cleanup from the doctype changes in ES 6.0. The pages below seem to have "type = log" references in both the LS and/or Filebeat examples. Perhaps we can change this to "doc" instead as its now the default in 6.0 for LS and Beats.

• Parsing Logs with Logstash
• Multiple Input and Output
• Dead Letter Queue docs

/cc @dedemorton

[dedemorton]

@acchen97 I've fixed the issues that you've identified. See #8603.

However, the Multiple Input and Output section looks OK to me. The first type field in the example is the prospector type. The second type field is a custom field that Filebeat adds to the event.

As you would expect, Filebeat sets the _type field in the metadata document to doc . It's possible I'm not fully understanding how this works, but I think the examples as they are written are OK. Can you check and close this issue if you're satisfied that the topic is correct? Thanks!

[acchen97]

@dedemorton your PR LGTM, let's close this out after that's merged. 👍

[acchen97]

Resolved with #8603.

[tbragin]

@acchen97 @andrewvc @dedemorton @jordansissel Looks like we missed one? Just came in via info@:
https://www.elastic.co/guide/en/logstash/current/config-examples.html

From the user:

Hi, Example provided at: https://www.elastic.co/guide/en/logstash/current/config-examples.html does not work with version 6.0.0 due to drastic change you made: https://www.elastic.co/guide/en/elasticsearch/reference/current/removal-of-types.html Error is: [2017-11-29T13:43:17,055][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2017.11.29", :_type=>"apache_access", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"logstash-2017.11.29", "_type"=>"apache_access", "_id"=>"Fg4GABHwoG4TihcXsi", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [logstash-2017.11.29] as the final mapping would have more than 1 type: [apache_access, apache_error]"}}}} Would be great to have the same example but that works with 6.0.0 ! Regards LI AR

[tbragin]

Another one?
https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html

[acchen97]

@tbragin the reason this is happening is due to the bug we had in the 6.0.0 release. This will be resolved OOTB in 6.0.1.

After further clarification with @andrewvc, I don't believe this warrants any necessary documentation changes. There is no _type field in LS, so the type fields that are specified here can still be used regardless for conditionals or just simply just being another field.

Closing this issue...