I could tell you how to manually fix your mapping, but that's not really helpful. I don't think there's a ton of people versed in Logstash (or even Beats) in these forums, you'd probably have better luck over in https://discuss.elastic.co/c/logstash

---