Datadog's reserved log attributes are confusing as heck. It's not clear what each attribute does, so you can’t predict or understand what will happen when you create a mapping. Allow me to demonstrate.
I got this logline from my Datadog S3 archive bucket. It gives you a sense of what logs look like after going through Datadog's opaque transformations.
{
"_id": "AW5Hc8y8FxIBf2udiA1a", // Log ID generated by Datadog
"attributes": { // Key-values from the original JSON logline are moved under "attributes"
"@timestamp": "2019-11-07T19:59:59.804Z",
"@version": "1",