I think I know what it is, but I wanted to see if anyone tried this and found a solution.
I run a website in a shared hosting and because I can't install filebeat but I have ssh access for log checking, I've implemented a sshfs solution to mount the logs folder in my filebeat server.
All works as expected, filebeat->Logstash->ElasticSearch-> Kibana... till today where I noticed that something was weird with a particular URL. Guess what.. its duplication 
So I know its something to do with the way I'm mounting the sshfs, I guess my couple questions are:
1- Has anyone tried this approach? Is it even supported?
2- If yes is there a way to prevent this duplication on the source?
Thanks for the help.