doc, _doc:

Error:

[2019-03-05T11:40:19,542][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"index_name-2019.03.05", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x6ff8bc52>], :response=>{"index"=>{"_index"=>"index_name-2019.03.05", "_type"=>"doc", "_id"=>"asdkfjhasdifbnsad", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [index_name-2019.03.05] as the final mapping would have more than 1 type: [_doc, doc]"}}}}

Solution:

I don’t know what is actually happening to cause this, but make add the following to the output{ elasticsearch {} } block in the logstash configuration to get it to push as type _doc:

output {
  elasticsearch {
    document_type => "_doc"
  }
}