You're right, I see "logs" in the "_type" field in my working  configuration.  But I don't see anything in my template ( that would be messing with that or "doc" or anything.

I've opened up a support case with AWS to see if they can give me copies of the logs, as this would be much easier to debug if I saw what ES what logging.