Seems like a bug. Shouldn’t this be of type [string]
Throwing constant errors: {“type”:“mapper_parsing_exception”,“reason”:“failed to parse field [winlogbeat_host_name] of type [date] in document with id ‘47f3d530-c8ec-11e9-a996-000c291b09e6’”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“Invalid format: “Ironwood””}}
this can happen because Elasticsearch tries on ingest to detect the type of data. So if a field is created the first time - that content type is used until the next index is created.
Best option you have - force specific content types with index templates.