I think this is broken in 6.X because of the removal of types. Because clone works with the type, when you change the type , you can't index into an index by a different name than the type else you get this error:
[2018-01-21T22:48:19,891][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"datetest2", :_type=>"logs", :_routing=>nil}, 2018-01-17T13:49:01.000Z %{host} %{message}], :response=>{"index"=>{"_index"=>"datetest2", "_type"=>"logs", "_id"=>"Eiz6GGEBmWU-DHWmG56E", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [datetest2] as the final mapping would have more than 1 type: [overlay, logs]"}}}}
I'm pulling in a datapoint from an index called overlay, and then I want to clone it, add a field to the clone and send it back to the same index but then the index has multiple types which is against the rules. :'(
I think this is broken in 6.X because of the removal of types. Because clone works with the type, when you change the type , you can't index into an index by a different name than the type else you get this error:
[2018-01-21T22:48:19,891][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"datetest2", :_type=>"logs", :_routing=>nil}, 2018-01-17T13:49:01.000Z %{host} %{message}], :response=>{"index"=>{"_index"=>"datetest2", "_type"=>"logs", "_id"=>"Eiz6GGEBmWU-DHWmG56E", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [datetest2] as the final mapping would have more than 1 type: [overlay, logs]"}}}}I'm pulling in a datapoint from an index called overlay, and then I want to clone it, add a field to the clone and send it back to the same index but then the index has multiple types which is against the rules. :'(