The default type for the Elasticsearch output plugin is 'doc' for Elasticsearch 6.x clusters, which is clashing with the 'netflow' type you have specified in the mapping. I suspect setting document_type => "netflow" in the Elasticsearch output should resolve the issue.