@Badger I've done some more testing and I was incorrect about the mapping changing. Having false as the value for dynamic does actually prevent the mapping changing, but the data seen in kibana appears to be the full _source of the data from logstash into elasticsearch. The values are persisted in elastic even though they arent indexed, or changes made to the mapping.
So am back to needing to find a way to reduce the payload from logstash to elasticsearch. I need to remove subkeys from the kubernetes top level field. As discussed previously this isnt possible with the prune filter, but I'm thinking it should be possible, maybe using ruby, like you recommended here: