I discovered that there's a mapping in Elasticsearch for a field that I wasn't expecting to be there, as that field is not present in any documents that are indexed (and was not present in any template).
The field is (sometimes) created during Logstash processing, but when it's created it is always removed again by a "remove_field" and so never gets as far as Elasticsearch.
So why does Elasticsearch have a mapping for this field it has never seen?