So I was able to figure out how to add more sub-fields except that the way that it works is it creates nested fields under the _default mapping.
I usually like to use document _types to pull apart.. well document types. Is there a reason you have designed it this way? I can see that you are going to start using the concept of modules. For example an nginx filebeat module that I assume would create fields like this:
To me it makes sense to have it be like:
I just think more deeply nested field names are harder to query?