Yes My Suggestion was to try straight from Filebeat to Elasticsearch just to test the line processing.
Also could you try just the codec => rubydebug instead of the json codec.
Also you could test the filebeat console output as well
output.console:
pretty: true
Yeah there is something "Unusual" going on this should all be pretty straightforward.