Field [_id] is a metadata field and cannot be added inside a document. Use the index API request parameters
I had the same issue when I was redirecting the cloudwatch logs to ElasticSearch by terraform. This was resolved by adding filter_pattern for cloudwatch subscription filter (before it was empty).
resource "aws_cloudwatch_log_subscription_filter" "cloudwatch_logs_to_es" { depends_on = [aws_lambda_permission.cloudwatch_allow] name = var.clw_subscription_filter_name log_group_name = aws_cloudwatch_log_group.auth0_log_group.name filter_pattern = "[host, ident, authuser, date, request, status, bytes]" destination_arn = aws_lambda_function.cwl_stream_lambda.arn}