azure.activitylogs.identity.claims.* field is meant to be a dynamic mapping, but is missing an 'object_type' so it will never be a dynamic mapping. Also consider specifying object_type_mapping_type to control the match_mapping_type value in the index template if that matters.

The generated mapping is for a literal field name containing *.

                "claims": {
                  "properties": {
                    "*": {
                      "type": "object"
                    }
                  }
                },