In EventToIndex.Java sending into ES with type alarmchange, the p_oldalarmvalues and p_newalarmvalues parameters are submitted as a single escaped string and not a unescaped JSON object containing multiple sub parameters.
See Attachments including updated ES mapping file.
Issue.txt - Direct from packet capture
eventsindextemplate.json - Newer structured mapping
This should link to