You're right, I see "logs" in the "_type" field in my working  configuration.  But I don't see anything in my template (https://gist.github.com/djcrabhat/ce74ca10d74748a657f8f5c45c4654f1) that would be messing with that or "doc" or anything.

I've opened up a support case with AWS to see if they can give me copies of the logs, as this would be much easier to debug if I saw what ES what logging.

---
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB