Right now it seems the autodiscovery plugin for docker is faulty. You can easily replicate by running filebeat as docker container and even natively.
There is no JSON error, but sometimes filebeat will json_decode the message field and sometimes not. As shown in my example above.
It ties to this problem as well: Docker + Persistent Registry = autodiscover failing
Once I switch away from autodiscovery everything works perfectly.