Thanks. removing -pretty resulted in a JSON file that Logstash attempted to parse this time, instead of not doing anything with it.
Looks like my next step is decide on a solution for mapping explosion. I'm grateful this article was posted. Will investigate and report back.
This is a common warning seen due to what is commonly known as a mapping explosion. The docs go into this is more detail, but quickly (emphasis by the author);
Defining too many fields in an index can lead to a mapping explosion, which can cause out of memory errors and difficult situations to recover from.
Consider a situation where every new document inserted introduces new fields, such as with dynamic mapping. Each new field is added to the index mapping, which can become a problem as the …