Dammit it was a stupid mistake. Note that in my logstash match I call the first field I get from my logs (a single char that identifies the record type) simply type - of course that conflicts with the document type already present, and my subsequent output then doesn't match any more.