Can't merge a non object mapping [EventId] with an object mapping [EventId]

In elasticsearch a field can be an object, or text (or date etc.), but it cannot be text on some documents and an object on others.

I see you also have fields called EventId.Id and EventId.Name. That should be OK, you can have dots in field names, but if you have previously parsed messages in a way that created an EventId field that contained Id and Name fields that would create exactly this issue.