I finally worked it out.
If the log paths are defined in filebeat.yml all is fine and working correctly. The misbehaviour only happens if the log paths are defined in modules.d/logstash.yml.
So this is not working (modules.d/logstash.yml):
- module: logstash
log:
enabled: true
var.paths: ["/logtemp17/*"]
And this is working (filebeat.yml):
filebeat.inputs:
- type: log
enabled: true
paths:
- /logtemp17/*