MappingParserException with no custom extractor

Graylog Central (peer support)
,
3

I traced the source of the errors by shutting off all inputs and then collectors for the new Beats input. The messages are coming from winlogbeats which is just using the out-of-the box collector. I’ve kept the collector shutdown since it wasn’t logging any messages anyway.
Here is the configuration:

 # Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
   hosts: ["graylog.XXX.XXX:5045"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - windows
winlogbeat:
  event_logs:
   - name: Application
   - name: System
   - name: Security

Can you give me some guidance as to where the parser is configured so I can modify it if necessary?