'action' doesn't default to 'create' (as datastreams is default)

[roaksoax]

The documentation for the 'action' setting says the following:

"Default value is create for data streams, and index for non-time series data."

Starting from 8.0, datastreams is now the default, however, it seems that the 'action' setting is not being set by whether datastreams is enabled or disabled.

Logstash information:

Logstash 8.1.2

Description of the problem including expected versus actual behavior:
I would have expected that because datastreams is enabled by default, that I wouldn't have to specify the 'action' setting.

Steps to reproduce:

1. Install Logstash and metricbeat
2. Configure Logstash with:

 input {
  beats {
    port => 5044
  }
}
output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200/"
      pipeline => "%{[@metadata][pipeline]}"
      user => "elastic"
      password => "password"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200/"
      user => "elastic"
      password => "password"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
    }
  }
}

Provide logs (if relevant):

:action=>["index",
[2022-04-21T08:41:13,559][WARN ][logstash.outputs.elasticsearch][main][d8e9b92d5d708958ec030423d27ccf66fb111900efd5ff96754c69edee4d7d80] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"metricbeat-8.1.2", :routing=>nil}, 
....
:response=>{"index"=>{"_index"=>"metricbeat-8.1.2", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"only write ops with an op_type of create are allowed in data streams"}}}}

[jsvd]

This happens because the plugin checks if a certain set of configurations is defined, and if any of those is present, it disables data streams. In this case, the manage_template => false is detected, and causes:

[2022-04-29T23:00:07,595][INFO ][logstash.outputs.elasticsearch][main] Config is not compliant with data streams. `data_stream => auto` resolved to `false`

Removing the manage_template => false makes it work again.

The logic should be improved to check if the defined setting is compatible or not with data streams instead of just checking if it's present.

[kares]

seems the author had the manage_template in mind but decided not to detect a false value:

        # NOTE: intentionally do not support explicit DS configuration like:
        # - `index => ...` identifier provided by data_stream_xxx settings
        # - `manage_template => false` implied by not setting the parameter

https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/v11.5.0/lib/logstash/outputs/elasticsearch/data_stream_support.rb#L110-L111

even if manage_template wasn't set, the index => "..." setting is the main show stopper (as intended).

[edmocosta]

As mentioned in the comments above, the data stream is being disabled due to the index option set on the plugin configuration, which makes the plugin not use the default action => create. There's a separate issue open to fix the manage_template => false problem #1093.

That said, this issue could focus on:

• Provide better log messages for data-streams incompatible settings/options. It's currently logging the datastream => auto resolved value but it doesn't provide many details about the cause. (unless it's in DEBUG level)
• Review all configuration options and improve the plugin documentation to clarify which options/values affect the datastream => auto mechanisms. It might be a new table or in the option description.

Any further thoughts, @jsvd?