He @Larsman
this can happen because Elasticsearch tries on ingest to detect the type of data. So if a field is created the first time - that content type is used until the next index is created.
Best option you have - force specific content types with index templates.
http://docs.graylog.org/en/3.1/pages/configuration/elasticsearch.html#custom-index-mappings