Please format your code using </> icon as explained in this guide. It will make your post more readable.
Impossible to tell without seeing what is exactly sent to elasticsearch.
Can you print/debug what is happening on the HTTP layer so we have a better idea?
What is the whole code?
May be first try to do it with pure REST calls (without PHP) and then do it using PHP?
Kibana Console will help you to do so. See an example in this guide.