Where I am today:
I discovered that Elastic provides tooling to do EXACTLY what I want:
- specify our own custom fields in a meaningful way
- integrate the ECS definitions
- create the templates in a format that logstash can apply to elasticsearch
It took roughly a day to get tooled up and get something production-ready using the ECS tooling in that repository. I'd strongly suggest looking at that; you can specify your new fields (and aliases for backwards compatibility!) in YAML files and then generate your index templates from that.
So now we'll be doing nothing alluded to in the original post . But I do like this new method better.