Need HELP with mapping referring to log output

[carmine.fabrizio (Carmine)]

Hi,
I am trying to understand how to define some static mapping, this is the log message that I have

Mar 12 17:27:16 dev-jenkins filebeat: 2020-03-12T17:27:16.768-0400#011INFO#011[monitoring]#011log/log.go:145#011Non-zero metrics in the last 30s#011{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":169260,"time":{"ms":17}},"total":{"ticks":267930,"time":{"ms":33},"value":267930},"user":{"ticks":98670,"time":{"ms":16}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"29de85a9-3829-48f3-9a37-83f35c65038e","uptime":{"ms":126930091}},"memstats":{"gc_next":10604144,"memory_alloc":9763784,"memory_total":7550838208},"runtime":{"goroutines":46}},"filebeat":{"events":{"added":1,"done":1},"harvester":{"files":{"ac2ff12a-149c-4962-9b61-9454123d53f3":{"last_event_published_time":"2020-03-12T17:26:53.726Z","last_event_timestamp":"2020-03-12T17:26:48.725Z","read_offset":1261,"size":1261}},"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":1,"batches":1,"total":1},"read":{"bytes":6},"write":{"bytes":1146}},"pipeline":{"clients":4,"events":{"active":0,"published":1,"total":1},"queue":{"acked":1}}},"registrar":{"states":{"current":2,"update":1},"writes":{"success":1,"total":1}},"system":{"load":{"1":0.01,"15":0.05,"5":0.02,"norm":{"1":0.005,"15":0.025,"5":0.01}}}}}}

as you can see is a Syslog message coming from the filebeat.
Let say I'd like to create a mapping based on this output and create the fields name on kibana, I should start to map the field like this

{
  "properties": {
    "monitoring.metrics.beat.cpu.system.ticks": {
      "full_name" : "cpu.system.ticks",
      "mapping": {
        "type": "number"
        }
      },
      "monitoring.metrics.beat.cpu.system.ticks.keyword": {
        "full_name" : "cpu.system.ticks.keyword",
        "mapping": {
          "keyword" : {
            "type": "keyword",
            "ignore_above" : 256
            }
        }
      }
  }
}

am I right? of course not coz It is not working ao any idea about what am I missing?
Thanks