securityonion/salt/elasticsearch/templates/component/elastic-agent/so-logs-mappings.json

      {
        "template": {
          "mappings": {
            "properties": {
              "data_stream": {
                "properties": {
                  "type": {
                    "type": "constant_keyword",
                    "value": "logs"
                  }
                }
              }
            }
          }
        },
        "version": 2,
        "_meta": {
          "managed": true,
          "description": "default mappings for the logs index template installed by x-pack"
        }
      }