Are you running Logstash as a service? Do you by any chance have more than one file containing an elasticsearch output in the config directory? Be aware that Logstash will concatenate all files into a single logical pipeline, which means that data from all inputs will go to all outputs unless you control the flow using conditionals.