The problem is to push json logs collected by Filebeat to Elasticsearch with defined \_type and \_id. Default elastic \_type is "log" and \_id is smth. like "AVryuUKMKNQ7xhVUFxN2".

My log row:

```
 {"unit_id":10001,"node_id":1,"message":"Msg ..."}

```

Desired record in Elasticsearch:

```
"hits" : [ {
    "_index" : "filebeat",
    "_type" : "unit_id",
    "_id" : "10001",
    ...
    "_source" : {        
        "message" : "Msg ...",
        "node_id" : 1,
        ...
    }
} ]

```

I know how to do it with Logstash, just use document\_id => "%{unit\_id}" and document\_type => "unit\_id" in the output section. The goal is to use only Filebeat. Because it is a very-light weight solution and no intermediate aggregation is needed here.