Hi Alex_Armstrong,
It looks like role label is used in different ways across your cluster, where some use role.something: value and this pod uses role: value. Sounds like this is the case?
As dots represent nesting in Elasticsearch, this is causing mapping issues (role is expected to be an object as for previous documents). You can use rename processor to rename role to something else that won't break the mapping: https://www.elastic.co/guide/en/beats/metricbeat/current/rename-fields.html
Best regards