Oh thank you thank you thank you!   That was exactly my problem.  I changed that property from "doc" to "logs" and it worked perfectly!  Sorry it took me so long to understand what you were suggesting, it all makes much more sense now.

Maybe I'll submit a PR to https://github.com/elastic/beats/blob/6.2/libbeat/docs/shared-template-load.asciidoc to make this a little more explicit/be on the lookout for logstash setting that "logs" type.

---