Every time the ElasticSearch Index rotates, the default action is to adjust the field type based on the first data that comes into it. Most likely what happened to you. First item in for SpanId was considered to be a keyword.
The way to specifically avoid this is to create a custom mapping where you specify the field type on index creation. I did an older write up here about this happening to me and how I set the custom mapping and corrected the historical data.
Good luck!