diff --git a/plugins/omelasticsearch/omelasticsearch.c b/plugins/omelasticsearch/omelasticsearch.c index 76d5081d3b..f481ec3f7e 100644 --- a/plugins/omelasticsearch/omelasticsearch.c +++ b/plugins/omelasticsearch/omelasticsearch.c @@ -620,6 +620,8 @@ setPostURL(wrkrInstanceData_t *const pWrkrData, uchar **const tpls) uchar *parent; uchar *bulkId; char* baseUrl; + /* since 7.0, the API always requires /idx/_doc, so use that if searchType is not explicitly set */ + uchar* actualSearchType = (uchar*)"_doc"; es_str_t *url; int r; DEFiRet; @@ -645,11 +647,12 @@ setPostURL(wrkrInstanceData_t *const pWrkrData, uchar **const tpls) if(searchIndex != NULL) { r = es_addBuf(&url, (char*)searchIndex, ustrlen(searchIndex)); if(r == 0) r = es_addChar(&url, '/'); - if(searchType != NULL) { - if(r == 0) r = es_addBuf(&url, (char*)searchType, ustrlen(searchType)); - } - } else - r = 0; + + if(searchType != NULL) { + actualSearchType = searchType; + } + if(r == 0) r = es_addChar(&url, '/'); + if(r == 0) r = es_addBuf(&url, (char*)actualSearchType, ustrlen(actualSearchType)); if(pipelineName != NULL && (!pData->skipPipelineIfEmpty || pipelineName[0] != '\0')) { if(r == 0) r = es_addChar(&url, separator); if(r == 0) r = es_addBuf(&url, "pipeline=", sizeof("pipeline=")-1); @@ -693,7 +696,7 @@ computeMessageSize(const wrkrInstanceData_t *const pWrkrData, const uchar *const message, uchar **const tpls) { - size_t r = sizeof(META_TYPE)-1 + sizeof(META_END)-1 + sizeof("\n")-1; + size_t r = sizeof(META_END)-1 + sizeof("\n")-1; if (pWrkrData->pData->writeOperation == ES_WRITE_CREATE) r += sizeof(META_STRT_CREATE)-1; else