You're right, I see "logs" in the "_type" field in my working  configuration.  But I don't see anything in my template (https://gist.github.com/djcrabhat/ce74ca10d74748a657f8f5c45c4654f1) that would be messing with that or "doc" or anything.

I've opened up a support case with AWS to see if they can give me copies of the logs, as this would be much easier to debug if I saw what ES what logging.

---