The included index templates for the logs-system.application + logs-system.system data streams don't explicitly map message as a text field, so it gets mapped as a keyword due to dynamic_templates:

"dynamic_templates": [
    {
      "strings_as_keyword": {
        "mapping": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "match_mapping_type": "string"
      }
    }
  ]

Other System integration data streams do map message as a text field, which ultimately results in a mapping conflict for the logs-* Kibana index pattern.