Most likely you have dynamic mapping enabled in elasticsearch. If the first document indexed has a value of [winlog][event_data][param1] that looks like a date then elasticsearch will set the field type to date, and any document on which that field is not a valid date will get that mapping exception. That is true no matter whether the event comes from filebeat or logstash. It just depends what the first document indexed looks like.
You need to add a template or otherwise set the mapping on the index. Note that you cannot change the type of a field once created. You will need to create a new index.
See this post for more colour.