When the auto index for ElasticSearch’s type on a field is incorrect, you can create custom mappings. In my case, the original mappings were created by Graylog (an alternative to log stash). You can created custom mappings according to this post. This post details more about how to get Graylog and ElasticSearch to pick up the custom mappings.