When Elasticsearch does automatically add schema for unknown/dynamic fields?
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
It's called dynamic field mapping and this is enabled by default.
You can disable that feature if necessary.