When rolling over an index, the LogsdbIndexModeSettingsProvider does not properly parse the mappings. This can sometimes cause a keyword mapper for host.name to be injected even when it will conflict with the current mapping.

Here's a yaml test to reproduce the issue;

rollover with host as keyword:
  - do:
      indices.put_index_template:
        name: "example"
        body:
          "index_patterns": [ "example*" ]
          "template":
            "settings":
              "mode": "logsdb"
            "mappings":
              "properties":
                "host":
                  "type": "text"
                "@timestamp":
                  "type": "date"
          "composed_of": []
          "priority": 500
          "data_stream": {}

  - do:
      index:
        index: "example"
        body:
          "@timestamp": "2025-01-01T00:00:00.000Z"
          "host": "test-host"

  - do:
     indices.rollover:
       alias: "example"

The problem is how the mapping is passed to the provider. When the initial index is created, the mapping has a root "_doc" element ({"_doc":{"properties":{"@timestamp"...), but when the next index is created with _rollover, there is no root "_doc" ({"properties":{"@timestamp"...). The settings provider filters the mapping before instantiating the dummy mapper service (so that it's only instantiating the mappers it needs to check), but the filters all assume the presence of an "_doc" root element (code).