Oh thank you thank you thank you!   That was exactly my problem.  I changed that property from "doc" to "logs" and it worked perfectly!  Sorry it took me so long to understand what you were suggesting, it all makes much more sense now.

Maybe I'll submit a PR to https://github.com/elastic/beats/blob/6.2/libbeat/docs/shared-template-load.asciidoc to make this a little more explicit/be on the lookout for logstash setting that "logs" type.

---
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB