Remove document_type from Filebeat

[ruflin]

The _type field was removed in elasticsearch 6.0. The initial intention of document_type was to define different _type. As this does not exist anymore the config option was removed. It is recommend to use fields instead to add specific fields to a prospector.

• Adjust tests accordingly

[tsg]

LGTM. I think we should deprecate the "document_type" option and the "type" output field in 5.5, right?

[ruflin]

Here is the PR to deprecate documen_type: #4225

[songlong]

but I can get _type in elasticsearch _type
how to change _type content?

{
"took": 2,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 190,
"max_score": 1,
"hits": [
{
"_index": "filebeat-2017.09.05",
"_type": "doc",
"_id": "AV5RdtRxzLm-HqSBIOFT",
"_score": 1,
"_source": {
"@timestamp": "2017-09-05T09:54:51.735Z",
"beat": {
"hostname": "s14.wzb.zwt.qihoo.net",
"name": "s14.wzb.zwt.qihoo.net",
"version": "5.5.2"
},
"body_bytes_sent": "29",
"fields": {
"type": "fotest"
},
"http_referrer": "-",
"http_user_agent": "Apache-HttpClient/4.5.2 (Java/1.8.0_73)",
"http_x_forwarded_for": "-",
"input_type": "log",
"offset": 414986605,
"remote_addr": "220.181.171.121",
"remote_user": "-",
"request": "POST /api/log/protect HTTP/1.1",
"request_method": "POST",
"request_time": "0.759",
"source": "/home/work/es_nginx/logs/access.log",
"status": "200",
"type": "nginx"
}
}
]
}
}